CVE-2026-90423: RDMA/rxe: Fix UAF in ODP init error-handling path
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix UAF in ODP init error-handling path
rxeodpmrinituser() stores &umemodp->umem in mr->umem before calling rxeodpinitpages(). If rxeodpinitpages() fails, rxeodpmrinituser() releases umemodp and returns an error.
rxeregusermr() then unwinds the error through rxecleanup(), rxemrcleanup(), ibumemrelease(mr->umem). There is an ISERRORNULL(umem) check at the start of ibumemrelease(). But since mr->umem is NOT reset to NULL in the error handling path of rxeodpmrinituser(), the check passes and it reads already-freed fields like umem->isdmabuf, causing UAF.
Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In rxe_odp_mr_init_user() error handling, clear mr->umem after releasing the failed umem so the MR cleanup path does not release it again.
Linux kernel (RDMA/rxe) ODP init error-handling path Clear mr->umem after releasing failed umem (UAF fix) = mr->umem cleared after ib_umem_release() on failure - Configuration
In ib_umem_release(), add an IS_ERR_OR_NULL(umem) check at the start to prevent use-after-free when umem may already be freed.
Linux kernel (ib_umem_release) IS_ERR_OR_NULL(umem) check = Add/start with IS_ERR_OR_NULL(umem) check - Compensating control
If running a kernel without this fix, mitigate by avoiding the specific RDMA/rxe ODP init path that triggers rxe_odp_init_pages() failures (e.g., do not exercise ODP initialization / ensure rxe_odp_init_pages() does not fail in your environment).
Event History
Frequently Asked Questions
When can the use-after-free occur?
It occurs when rxe_odp_init_pages() fails during initialization of a user ODP memory region. The failed ODP umem is released, but mr->umem still points to it and the subsequent cleanup path attempts to release it again.
What component and configuration path are involved?
The issue is in the Linux kernel RDMA rxe driver, specifically its on-demand paging (ODP) user memory-region initialization and error-unwind path. The provided information does not establish whether this path is enabled or reachable in a default configuration.
How does the fix prevent the issue?
After releasing the failed ODP umem, the fix clears mr->umem. This causes the later MR cleanup path to avoid releasing the already-freed umem a second time.