CVE-2026-46325: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

Published Jun 9, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGESIZE

The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGESIZE. The core issue is that rxesetpage() is called with mr->pagesize step increments, but the pagelist stores individual struct page pointers, each representing PAGESIZE of memory.

ibsgtopage() has ensured that when i>=1 either a) SG[i-1].dmaend and SG[i].dmaaddr are contiguous or b) SG[i-1].dmaend and SG[i].dmaaddr are mr->pagesize aligned.

This leads to incorrect iova-to-va conversion in scenarios:

1) pagesize < PAGESIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dmaaddr=0x181800, len=0x800 sg[1]: dmaaddr=0x173000, len=0x1000

Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - pageoffset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)

2) pagesize > PAGESIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dmaaddr=0x18f800, len=0x800 sg[1]: dmaaddr=0x170000, len=0x1000

Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - pageoffset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dmaaddr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)

Yi Zhang reported a kernel panic[1] years ago related to this defect.

Solution: 1. Replace xarray with pre-allocated rxemrpage array for sequential indexing (all MR page indices are contiguous) 2. Each rxemrpage stores both struct page and offset within the system page 3. Handle MR pagesize != PAGESIZE relationships: - pagesize > PAGESIZE: Split MR pages into multiple system pages - pagesize <= PAGESIZE: Store offset within system page 4. Add boundary checks and compatibility validation

This ensures correct iova-to-va conversion regardless of MR page size and system PAGESIZE relationship, while improving performance through array-based sequential access.

Tests on 4K and 64K PAGESIZE hosts: - rdma-core/pytests $ ./build/bin/runtests.py --dev eth0rxe - blktest: $ TIMEOUT=30 QUICKRUN=1 USERXE=1 NVMETTRTYPES=rdma ./check nvme srp rnbd

[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/

Affected Software

158 affected componentsFixes available
Linux Linux kernel (RDMA rxe)
Linux Linux kernel>=6.2.3<6.18.14
Linux Linux kernel>=6.19<6.19.4
debian/linux<6.12.115-2
6.12.115-2
debian/linux<6.18.14-1
6.18.14-1
debian/linux<=6.12.107-1
6.1.176-16.1.190-16.12.116-17.2.15-17.3.3-1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1062.65~22.04.2
6.8.0-1062.65~22.04.2
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1064.72~22.04.1
6.8.0-1064.72~22.04.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8<6.8.0-1063.70~22.04.1
6.8.0-1063.70~22.04.1
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1065.73~22.04.1
6.8.0-1065.73~22.04.1
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-138.138~22.04.1
6.8.0-138.138~22.04.1
ubuntu/linux-ibm-6.8<6.8.0-1062.63~22.04.1
6.8.0-1062.63~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-137.137.1~22.04.1
6.8.0-137.137.1~22.04.1
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1060.63~22.04.1
6.8.0-1060.63~22.04.1
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1059.62~22.04.1
6.8.0-1059.62~22.04.1
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-137.137~22.04.1
6.8.0-137.137~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime-6.8<6.8.1-1057.58~22.04.1
6.8.1-1057.58~22.04.1
ubuntu/linux<6.8.0-137.137
6.8.0-137.137
ubuntu/linux-aws<6.8.0-1062.65
6.8.0-1062.65
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17<6.17.0-1019.19~24.04.1
6.17.0-1019.19~24.04.1
ubuntu/linux-azure<6.8.0-1064.72
6.8.0-1064.72
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17<6.17.0-1021.21~24.04.1
6.17.0-1021.21~24.04.1
ubuntu/linux-azure-fde<6.8.0-1063.70
6.8.0-1063.70
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-fde-6.17<6.17.0-1018.18~24.04.1
6.17.0-1018.18~24.04.1
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1065.73
6.8.0-1065.73
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-6.17<6.17.0-1020.22~24.04.1
6.17.0-1020.22~24.04.1
ubuntu/linux-gke<6.8.0-1060.68
6.8.0-1060.68
ubuntu/linux-gkeop<6.8.0-1047.51
6.8.0-1047.51
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17<6.17.0-40.40~24.04.1
6.17.0-40.40~24.04.1
ubuntu/linux-ibm<6.8.0-1062.63
6.8.0-1062.63
ubuntu/linux-lowlatency<6.8.0-137.137.1
6.8.0-137.137.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia<6.8.0-1060.63
6.8.0-1060.63
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17<6.17.0-1026.26
6.17.0-1026.26
ubuntu/linux-nvidia-lowlatency<6.8.0-1060.63.1
6.8.0-1060.63.1
ubuntu/linux-nvidia-tegra<6.8.0-1031.32
6.8.0-1031.32
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17<6.17.0-1028.28
6.17.0-1028.28
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1059.62
6.8.0-1059.62
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17<6.17.0-1018.18~24.04.1
6.17.0-1018.18~24.04.1
ubuntu/linux-raspi<6.8.0-1062.66
6.8.0-1062.66
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17*
ubuntu/linux-vmware<6.8.0-1008.8
6.8.0-1008.8
ubuntu/linux-xilinx<6.8.0-1034.35
6.8.0-1034.35
ubuntu/linux-bluefield<6.8.0-1028.33
6.8.0-1028.33
ubuntu/linux-raspi-realtime<6.8.0-2051.53
6.8.0-2051.53
ubuntu/linux-realtime<6.8.1-1057.58
6.8.1-1057.58
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17<6.17.0-1017.19~24.04.1
6.17.0-1017.19~24.04.1
ubuntu/linux-aws-fips<6.8.0-1062.65+fips1
6.8.0-1062.65+fips1
ubuntu/linux-azure-fips<6.8.0-1064.72+fips1
6.8.0-1064.72+fips1
ubuntu/linux-fips<6.8.0-137.137+fips1
6.8.0-137.137+fips1
ubuntu/linux-gcp-fips<6.8.0-1065.73+fips1
6.8.0-1065.73+fips1
ubuntu/linux<6.17.0-40.40
6.17.0-40.40
ubuntu/linux-aws<6.17.0-1019.19
6.17.0-1019.19
ubuntu/linux-azure*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp<6.17.0-1020.22
6.17.0-1020.22
ubuntu/linux-oracle<6.17.0-1018.18
6.17.0-1018.18
ubuntu/linux-raspi<6.17.0-1021.21
6.17.0-1021.21
ubuntu/linux-realtime<6.17.0-1017.19
6.17.0-1017.19
ubuntu/linux-riscv<6.17.0-40.40.1
6.17.0-40.40.1
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.12.115-2
  2. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.18.14-1
  3. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.65~22.04.2
  4. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72~22.04.1
  5. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.70~22.04.1
  6. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1065.73~22.04.1
  7. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-138.138~22.04.1
  8. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.63~22.04.1
  9. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-137.137.1~22.04.1
  10. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63~22.04.1
  11. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62~22.04.1
  12. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-137.137~22.04.1
  13. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1057.58~22.04.1
  14. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-137.137
  15. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.65
  16. Upgrade

    Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1019.19~24.04.1
  17. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72
  18. Upgrade

    Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1021.21~24.04.1
  19. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.70
  20. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1018.18~24.04.1
  21. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1065.73
  22. Upgrade

    Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1020.22~24.04.1
  23. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.68
  24. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1047.51
  25. Upgrade

    Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-40.40~24.04.1
  26. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.63
  27. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-137.137.1
  28. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63
  29. Upgrade

    Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1026.26
  30. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63.1
  31. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1031.32
  32. Upgrade

    Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1028.28
  33. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62
  34. Upgrade

    Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1018.18~24.04.1
  35. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.66
  36. Upgrade

    Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.

    Fixed in 6.8.0-1008.8
  37. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1034.35
  38. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.33
  39. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2051.53
  40. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1057.58
  41. Upgrade

    Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1017.19~24.04.1
  42. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.65+fips1
  43. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72+fips1
  44. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-137.137+fips1
  45. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1065.73+fips1
  46. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.17.0-40.40
  47. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.17.0-1019.19
  48. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.17.0-1020.22
  49. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.17.0-1018.18
  50. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.17.0-1021.21
  51. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.17.0-1017.19
  52. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.17.0-40.40.1
  53. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
  54. Compensating control

    Fix RDMA/rxe IOVA-to-VA conversion for MR page sizes different from system PAGE_SIZE: replace the xarray with a pre-allocated rxe_mr_page array for contiguous sequential indexing, split MR pages into multiple system pages when page_size > PAGE_SIZE, store the offset within the system page when page_size <= PAGE_SIZE, and add boundary checks and compatibility validation.

Event History

Jun 9, 2026
CVE Published
via MITRE·12:25 PM
Data Sourced
via MITRE·12:25 PM
DescriptionSeverity
Data Sourced
via Red Hat·02:01 PM
DescriptionSeverityAffected Software
Data Sourced
via OSV·02:16 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·02:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 10, 2026
Data Sourced
via Microsoft·08:06 AM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2026-46325?

The severity of CVE-2026-46325 is rated at 37.

2

How do I fix CVE-2026-46325?

To fix CVE-2026-46325, ensure that you update to the latest version of the Linux kernel which includes the patch.

3

What systems are affected by CVE-2026-46325?

CVE-2026-46325 affects the Linux kernel specifically with the RDMA rxe implementation.

4

What risks are associated with CVE-2026-46325?

The risk associated with CVE-2026-46325 includes potential mishandling of memory regions leading to system instability or security breaches.

5

What does CVE-2026-46325 address?

CVE-2026-46325 addresses the incorrect handling of memory region page sizes that differ from the system PAGE_SIZE in the Linux kernel.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203