CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Validate pad and ICRC before payloadsize() in rxercv
rxercv() currently checks only that the incoming packet is at least headersize(pkt) bytes long before payloadsize() is used.
However, payloadsize() subtracts both the attacker-controlled BTH pad field and RXEICRCSIZE from pkt->paylen:
payloadsize = pkt->paylen - offset[RXEPAYLOAD] - bthpad(pkt) - RXEICRCSIZE
This means a short packet can still make payloadsize() underflow even if it includes enough bytes for the fixed headers. Simply requiring headersize(pkt) + RXEICRCSIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payloadsize() negative and pass an underflowed value to later receive-path users.
Fix this by validating pkt->paylen against the full minimum length required by payloadsize(): headersize(pkt) + bthpad(pkt) + RXEICRCSIZE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.180-1~deb11u1 - Configuration
In rxe_rcv(), before payload_size() is used, validate pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE, so that payload_size() cannot underflow when BTH pad and ICRC fields are attacker-influenced.
Linux kernel RDMA/rxe (rxe_rcv) Packet length validation order/logic = Validate that pkt->paylen is at least header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE before calling payload_size()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46043?
The severity of CVE-2026-46043 is critical with a CVSS score of 9.1.
How do I fix CVE-2026-46043?
To fix CVE-2026-46043, update the Linux kernel to the latest version that includes the patches addressing this vulnerability.
What systems are impacted by CVE-2026-46043?
CVE-2026-46043 affects the Linux kernel, specifically the rxe RDMA component.
What kind of attack does CVE-2026-46043 facilitate?
CVE-2026-46043 could allow an attacker to exploit vulnerabilities in packet handling, potentially leading to data corruption or unauthorized access.
Is CVE-2026-46043 likely to be exploited in the wild?
Given its critical severity, CVE-2026-46043 could be targeted for exploitation in the wild, making timely remediation essential.