UBUNTU-CVE-2026-46325: Critical severity ubuntu/linux-hwe-edge vulnerability

Q: Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-hwe-edge, ubuntu/linux-gke, and ubuntu/linux-gkeop.

Q: What conditions are involved in triggering the incorrect address conversion?

The issue occurs when RXE handles memory regions whose configured page size differs from the system PAGE_SIZE. The described problematic cases include both memory-region page sizes smaller than PAGE_SIZE and larger than PAGE_SIZE.

Q: What does the severity information indicate about attacker access and potential impact?

The supplied CVSS vector rates this as critical at 9.8, with network attack vector, low attack complexity, no required privileges, and no user interaction. It indicates high potential impact to confidentiality, integrity, and availability.

Published Jun 9, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGESIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGESIZE. The core issue is that rxesetpage() is called with mr->pagesize step increments, but the pagelist stores individual struct page pointers, each representing PAGESIZE of memory. ibsgtopage() has ensured that when i>=1 either a) SG[i-1].dmaend and SG[i].dmaaddr are contiguous or b) SG[i-1].dmaend and SG[i].dmaaddr are mr->pagesize aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) pagesize < PAGESIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dmaaddr=0x181800, len=0x800 sg[1]: dmaaddr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - pageoffset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) pagesize > PAGESIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dmaaddr=0x18f800, len=0x800 sg[1]: dmaaddr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - pageoffset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dmaaddr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxemrpage array for sequential indexing (all MR page indices are contiguous) 2. Each rxemrpage stores both struct page and offset within the system page 3. Handle MR pagesize != PAGESIZE relationships: - pagesize > PAGESIZE: Split MR pages into multiple system pages - pagesize <= PAGESIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGESIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGESIZE hosts: - rdma-core/pytests $ ./build/bin/runtests.py --dev eth0rxe - blktest: $ TIMEOUT=30 QUICKRUN=1 USERXE=1 NVMETTRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/

Affected Software

152 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1062.65~22.04.2

6.8.0-1062.65~22.04.2

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1064.72~22.04.1

6.8.0-1064.72~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1063.70~22.04.1

6.8.0-1063.70~22.04.1

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1065.73~22.04.1

6.8.0-1065.73~22.04.1

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-138.138~22.04.1

6.8.0-138.138~22.04.1

ubuntu/linux-ibm-6.8<6.8.0-1062.63~22.04.1

6.8.0-1062.63~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-137.137.1~22.04.1

6.8.0-137.137.1~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1060.63~22.04.1

6.8.0-1060.63~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1059.62~22.04.1

6.8.0-1059.62~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-137.137~22.04.1

6.8.0-137.137~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1057.58~22.04.1

6.8.1-1057.58~22.04.1

ubuntu/linux<6.8.0-137.137

6.8.0-137.137

ubuntu/linux-aws<6.8.0-1062.65

6.8.0-1062.65

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17<6.17.0-1019.19~24.04.1

6.17.0-1019.19~24.04.1

ubuntu/linux-azure<6.8.0-1064.72

6.8.0-1064.72

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17<6.17.0-1021.21~24.04.1

6.17.0-1021.21~24.04.1

ubuntu/linux-azure-fde<6.8.0-1063.70

6.8.0-1063.70

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17<6.17.0-1018.18~24.04.1

6.17.0-1018.18~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1065.73

6.8.0-1065.73

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1020.22~24.04.1

6.17.0-1020.22~24.04.1

ubuntu/linux-gke<6.8.0-1060.68

6.8.0-1060.68

ubuntu/linux-gkeop<6.8.0-1047.51

6.8.0-1047.51

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17<6.17.0-40.40~24.04.1

6.17.0-40.40~24.04.1

ubuntu/linux-ibm<6.8.0-1062.63

6.8.0-1062.63

ubuntu/linux-lowlatency<6.8.0-137.137.1

6.8.0-137.137.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1060.63

6.8.0-1060.63

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1026.26

6.17.0-1026.26

ubuntu/linux-nvidia-lowlatency<6.8.0-1060.63.1

6.8.0-1060.63.1

ubuntu/linux-nvidia-tegra<6.8.0-1031.32

6.8.0-1031.32

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1028.28

6.17.0-1028.28

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1059.62

6.8.0-1059.62

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1018.18~24.04.1

6.17.0-1018.18~24.04.1

ubuntu/linux-raspi<6.8.0-1062.66

6.8.0-1062.66

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-vmware<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-xilinx<6.8.0-1034.35

6.8.0-1034.35

ubuntu/linux-bluefield<6.8.0-1028.33

6.8.0-1028.33

ubuntu/linux-raspi-realtime<6.8.0-2051.53

6.8.0-2051.53

ubuntu/linux-realtime<6.8.1-1057.58

6.8.1-1057.58

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1017.19~24.04.1

6.17.0-1017.19~24.04.1

ubuntu/linux-aws-fips<6.8.0-1062.65+fips1

6.8.0-1062.65+fips1

ubuntu/linux-azure-fips<6.8.0-1064.72+fips1

6.8.0-1064.72+fips1

ubuntu/linux-fips<6.8.0-137.137+fips1

6.8.0-137.137+fips1

ubuntu/linux-gcp-fips<6.8.0-1065.73+fips1

6.8.0-1065.73+fips1

ubuntu/linux<6.17.0-40.40

6.17.0-40.40

ubuntu/linux-aws<6.17.0-1019.19

6.17.0-1019.19

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<6.17.0-1020.22

6.17.0-1020.22

ubuntu/linux-oracle<6.17.0-1018.18

6.17.0-1018.18

ubuntu/linux-raspi<6.17.0-1021.21

6.17.0-1021.21

ubuntu/linux-realtime<6.17.0-1017.19

6.17.0-1017.19

ubuntu/linux-riscv<6.17.0-40.40.1

6.17.0-40.40.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.65~22.04.2
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.70~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1065.73~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-138.138~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.63~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-137.137.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-137.137~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1057.58~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-137.137
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.65
Upgrade
Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1019.19~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72
Upgrade
Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1021.21~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.70
Upgrade
Upgrade ubuntu/linux-azure-fde-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.18~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1065.73
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1020.22~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.68
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.51
Upgrade
Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-40.40~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.63
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-137.137.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1026.26
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1031.32
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1028.28
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.18~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.66
Upgrade
Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1034.35
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.33
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2051.53
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1057.58
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1017.19~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.65+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-137.137+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1065.73+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-40.40
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.17.0-1019.19
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.17.0-1020.22
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.18
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1021.21
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1017.19
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.17.0-40.40.1

Event History

Jun 9, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-hwe-edge, ubuntu/linux-gke, and ubuntu/linux-gkeop.

What conditions are involved in triggering the incorrect address conversion?

The issue occurs when RXE handles memory regions whose configured page size differs from the system PAGE_SIZE. The described problematic cases include both memory-region page sizes smaller than PAGE_SIZE and larger than PAGE_SIZE.

What does the severity information indicate about attacker access and potential impact?

The supplied CVSS vector rates this as critical at 9.8, with network attack vector, low attack complexity, no required privileges, and no user interaction. It indicates high potential impact to confidentiality, integrity, and availability.

UBUNTU-CVE-2026-46325: Critical severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

What conditions are involved in triggering the incorrect address conversion?

What does the severity information indicate about attacker access and potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

What conditions are involved in triggering the incorrect address conversion?

What does the severity information indicate about attacker access and potential impact?