CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix OOB in freerdatomicresources()
freerdatomicresources() iterates using qp->attr.maxdestrdatomic. Updating maxdestrdatomic before freeing the old array can make the free path walk past the old allocation and trigger a slab out-of-bounds write catched by KASAN: ================================================================== BUG: KASAN: slab-out-of-bounds in freerdatomicresource drivers/infiniband/sw/rxe/rxeqp.c:180 [inline] BUG: KASAN: slab-out-of-bounds in freerdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:171 [inline] BUG: KASAN: slab-out-of-bounds in freerdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:163 [inline] BUG: KASAN: slab-out-of-bounds in rxeqpfromattr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxeqp.c:712 Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063
CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x10e/0x1f0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0xf7/0x600 mm/kasan/report.c:482 kasanreport+0xe4/0x120 mm/kasan/report.c:595 freerdatomicresource drivers/infiniband/sw/rxe/rxeqp.c:180 [inline] freerdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:171 [inline] freerdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:163 [inline] rxeqpfromattr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxeqp.c:712 rxemodifyqp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxeverbs.c:623 ibsecuritymodifyqp+0x223/0xfa0 drivers/infiniband/core/security.c:625 ibmodifyqp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modifyqp+0x13ca/0x1940 drivers/infiniband/core/uverbscmd.c:1932 ibuverbsmodifyqp+0xcb/0x120 drivers/infiniband/core/uverbscmd.c:1958 ibuverbswrite+0xb86/0x1030 drivers/infiniband/core/uverbsmain.c:680 vfswrite+0x2aa/0x1070 fs/readwrite.c:686 ksyswrite+0x1f8/0x250 fs/readwrite.c:740 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x116/0x800 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7fefc75a70cd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIGRAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007 RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0 </TASK>
Allocated by task 11063: kasansavestack+0x33/0x60 mm/kasan/common.c:57 kasansavetrack+0x14/0x30 mm/kasan/common.c:78 poisonkmallocredzone mm/kasan/common.c:398 [inline] kasankmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 [inline] dokmallocnode mm/slub.c:5296 [inline] kmallocnoprof+0x32a/0x850 mm/slub.c:5308 kmallocnoprof include/linux/slab.h:954 [inline] kzallocnoprof include/linux/slab.h:1188 [inline] allocrdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:155 [inline] rxeqpfromattr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxeqp.c:714 rxemodifyqp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxeverbs.c:623 ibsecuritymodifyqp+0x223/0xfa0 drivers/infiniband/core/security.c:625 ibmodifyqp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modifyqp+0x13ca/0x1940 drivers/infiniband/core/uverbscmd.c:1932 ibuverbsmodifyqp+0xcb/0x120 drivers/infiniband/core/uverbscmd.c:1958 ibuverbswrite+0xb86/0x1030 drivers/infiniband/core/uverbsma ---truncated---
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using the RDMA software RXE driver. The vulnerable path is reached while updating queue-pair attributes involving max_dest_rd_atomic.
What condition triggers the out-of-bounds write?
The condition occurs when max_dest_rd_atomic is updated before the array allocated for its previous value is freed. The cleanup routine then uses the new value to iterate over the old, smaller allocation.
How can administrators identify a possible occurrence?
A KASAN-enabled kernel may report a slab-out-of-bounds write in free_rd_atomic_resource or free_rd_atomic_resources, with the call path reaching rxe_qp_from_attr. The report describes a write of size 4 during cleanup of RD atomic resources.
What remediation is available?
The vulnerability is described as resolved, and stable kernel fix references are provided. Update to a kernel containing the applicable referenced fix.