CVE-2026-46114

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c

unconditionally dereferences 8 bytes at payload_addr(pkt):

value = *(u64 *)payload_addr(pkt);

check_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==

resid == 0 because the length validation only compared pktlen against

resid. A remote initiator that sets the RETH length to 0 therefore reaches

atomic_write_reply() with a zero-byte logical payload, and the responder

reads sizeof(u64) bytes from past the logical end of the packet into

skb->head tailroom, then writes those 8 bytes into the attacker's MR via

rxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel

tailroom per probe (the other 4 bytes are the packet's own trailing ICRC).

IBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is

protocol-invalid. Hoist a strict length check into check_rkey() so

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References