CVE-2026-90423: RDMA/rxe: Fix UAF in ODP init error-handling path
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix UAF in ODP init error-handling path
rxeodpmrinituser() stores &umemodp->umem in mr->umem before calling rxeodpinitpages(). If rxeodpinitpages() fails, rxeodpmrinituser() releases umemodp and returns an error.
rxeregusermr() then unwinds the error through rxecleanup(), rxemrcleanup(), ibumemrelease(mr->umem). There is an ISERRORNULL(umem) check at the start of ibumemrelease(). But since mr->umem is NOT reset to NULL in the error handling path of rxeodpmrinituser(), the check passes and it reads already-freed fields like umem->isdmabuf, causing UAF.
Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
When can the use-after-free occur?
It occurs when rxe_odp_init_pages() fails during initialization of a user ODP memory region. The failed ODP umem is released, but mr->umem still points to it and the subsequent cleanup path attempts to release it again.
What component and configuration path are involved?
The issue is in the Linux kernel RDMA rxe driver, specifically its on-demand paging (ODP) user memory-region initialization and error-unwind path. The provided information does not establish whether this path is enabled or reachable in a default configuration.
How does the fix prevent the issue?
After releasing the failed ODP umem, the fix clears mr->umem. This causes the later MR cleanup path to avoid releasing the already-freed umem a second time.