Linux Kernel RDMA/rxe UAF Fix on modify_qp
CVE-2026-80864 Published on September 4, 2026
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the
IB_QP_STATE path, so it holds no state_lock and runs while the responder
task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting
only that attribute calls free_rd_atomic_resources() then
alloc_rd_atomic_resources(), swapping qp->resp.resources[] while
rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources()
also leaves the cached pointer qp->resp.res dangling. A local
unprivileged user can race the free/realloc into a use-after-free in
rxe_receiver() (local DoS).
Drain recv_task around the swap with rxe_disable_task()/rxe_enable_task(),
as rxe_qp_reset() already does when tearing this array down, re-enabling
only after alloc_rd_atomic_resources() succeeds so the responder never
resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear
qp->resp.res in free_rd_atomic_resources(), like the rxe_resp.c
completion paths.
Reproduced under KASAN; the slab-use-after-free in rxe_receiver() is gone.
Products Associated with CVE-2026-80864
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8700e3e7c4857d28ebaa824509934556da0b3e76 and below 0136b528b753c5a56e4d997ef20b86bb6750b8fb is affected.
- Version 8700e3e7c4857d28ebaa824509934556da0b3e76 and below ffa4f0be69656be1755090f02db38d49816585c6 is affected.
- Version 8700e3e7c4857d28ebaa824509934556da0b3e76 and below d4cd32eb8bd2b0ffbdc7b1f3d82ce6a371f8f844 is affected.
- Version 8700e3e7c4857d28ebaa824509934556da0b3e76 and below 60dfd47929cd1e7070daa810d40ce538d888410d is affected.
- Version 8700e3e7c4857d28ebaa824509934556da0b3e76 and below 6f7014237405e7f032b5c53a82d9eccf6161c291 is affected.
- Version 4.8 is affected.
- Before 4.8 is unaffected.
- Version 6.12.108, <= 6.12.* is unaffected.
- Version 6.18.49, <= 6.18.* is unaffected.
- Version 7.1.13, <= 7.1.* is unaffected.
- Version 7.2.3, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.