CVE-2026-64582

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix a use-after-free problem in rxe_mmap

rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list

and releases pending_lock while the struct's kref is still at 1:

list_del_init(&ip->pending_mmaps);

spin_unlock_bh(&rxe->pending_lock); /* ref == 1, no lock held */

ret = remap_vmalloc_range(vma, ip->obj, 0); /* walks PTEs */

[...]

rxe_vma_open(vma); /* kref_get, ref → 2 */

remap_vmalloc_range_partial() walks PTEs without any lock.

A concurrent DESTROY_CQ ioctl on another CPU calls:

kref_put(&q->ip->ref, rxe_mmap_release) /* ref 1→0 */

vfree(ip->obj) /* clears vmalloc PTEs mid-walk */

kfree(ip) /* frees rxe_mmap_info */

This yields:

1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the

per-PTE race -> vm_insert_page(NULL) → GPF in validate_page_before_insert

2. Page UAF, vmalloc_to_page() reads a stale PTE b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References