CVE-2026-90423 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems that utilize RDMA/rxe functionality should assess exposure and verify if their systems are affected. This vulnerability could potentially allow local attackers to escalate privileges or cause a denial of service.

Why it matters

This use-after-free vulnerability in the Linux kernel's RDMA/rxe component could allow local attackers to escalate privileges or cause a denial of service. Linux kernel developers, maintainers, and users of systems utilizing RDMA/rxe should verify exposure and apply patches to prevent exploitation. Evidence from the CVE record and NVD entry supports these conclusions, but further verification of affected versions and system exposure is necessary.

• Local privilege escalation is possible if an attacker can trigger the use-after-free condition
• Denial of service (DoS) could occur if the vulnerability is exploited, potentially leading to system instability
• Verification of affected versions and application of patches is necessary to prevent exploitation

Technical summary

The vulnerability exists in the Linux kernel's RDMA/rxe component. Specifically, the rxe_odp_mr_init_user() function stores a pointer to 'umem_odp->umem' in 'mr->umem' before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, rxe_odp_mr_init_user() releases 'umem_odp' but does not reset 'mr->umem' to NULL. This leads to a use-after-free condition when rxe_cleanup() and ib_umem_release(mr->umem) are called later, as the check for IS_ERR_OR_NULL(umem) passes, causing the code to access already-freed memory.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to fix the vulnerability
• Update Linux kernel to a version that includes the fix
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. Three source references are provided, detailing specific commits related to the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.