CVE-2026-46325

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

The current implementation incorrectly handles memory regions (MRs) with

page sizes different from the system PAGE_SIZE. The core issue is that

rxe_set_page() is called with mr->page_size step increments, but the

page_list stores individual struct page pointers, each representing

PAGE_SIZE of memory.

ib_sg_to_page() has ensured that when i>=1 either

a) SG[i-1].dma_end and SG[i].dma_addr are contiguous

or

b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned.

This leads to incorrect iova-to-va conversion in scenarios:

1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K):

ibmr->iova = 0x181800

sg[0]: dma_addr=0x181800, len=0x800

sg[1]: dma_addr=0x173000, len=0x1000

Access iova = 0x181800 + 0x810 = 0x182010

Expected VA: 0x173010 (second SG, offset 0x10)

Before fix:

- index = (0x182010 >> 12) - (0x181800 >> 12) = 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References