CVE-2026-46043

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

rxe_rcv() currently checks only that the incoming packet is at least

header_size(pkt) bytes long before payload_size() is used.

However, payload_size() subtracts both the attacker-controlled BTH pad

field and RXE_ICRC_SIZE from pkt->paylen:

payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt)

- RXE_ICRC_SIZE

This means a short packet can still make payload_size() underflow even

if it includes enough bytes for the fixed headers. Simply requiring

header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a

packet with a forged non-zero BTH pad can still leave payload_size()

negative and pass an underflowed value to later receive-path users.

Fix this by validating pkt->paylen against the full minimum length

required by payload_size(): header_size(pkt) + bth_pad(pkt) +

RXE_ICRC_SIZE.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References