{"id":"CVE-2026-98365","published":"2026-10-06T09:18:30.677","lastModified":"2026-10-07T07:17:10.830","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access\n\nmr_check_range() validates that [iova, iova+length) falls within the\nregistered MR range using wraparound-prone arithmetic:\n\n    if (iova < mr->ibmr.iova ||\n        iova + length > mr->ibmr.iova + mr->ibmr.length)\n\nA remote peer can craft an RDMA-Write/Read RETH so that iova + length\nwraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the\ncheck. rxe_mr_iova_to_index() then computes a huge index (int idx, only\nguarded by WARN_ON) and rxe_mr_copy_xarray() dereferences\nmr->page_info[huge], causing an out-of-bounds read/write and a kernel\noops that is triggerable by an unauthenticated remote peer.\n\nRewrite the check in overflow-safe form; the first two clauses guarantee\nthat the subsequent subtractions do not underflow:\n\n    if (iova < mr->ibmr.iova ||\n        length > mr->ibmr.length ||\n        iova - mr->ibmr.iova > mr->ibmr.length - length)\n\nWith the fix, mr_check_range() returns -EINVAL for the crafted iova and\nthe responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/2f3b705144e3a3c14184fec6e354680081fe91ec","tags":[]},{"url":"https://git.kernel.org/stable/c/3431f525718f6b07da308cda6d44f8cb548bbd37","tags":[]},{"url":"https://git.kernel.org/stable/c/5d9426a74fc8cb8f375fcdc19b465a030f9b8cab","tags":[]},{"url":"https://git.kernel.org/stable/c/b7d2118660545a00b21e83010ded1a231c6fb8c5","tags":[]},{"url":"https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is an integer overflow in the mr_check_range() function, allowing a remote peer to perform out-of-bounds access, leading to potential kernel crashes and data corruption.","exploitability":"Exploitation is relatively easy given the preconditions of a crafted RDMA-Write/Read RETH packet from a remote peer.","blast_radius":"If exploited, this vulnerability could lead to a complete system compromise, as an unauthenticated remote peer can trigger a kernel oops and potentially execute arbitrary code.","remediation":"Upgrade to the Linux kernel version 6.2.10 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rdma","kernel","oob","critical"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:43:00.553Z"}}