CVE-2026-80864

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the

IB_QP_STATE path, so it holds no state_lock and runs while the responder

task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting

only that attribute calls free_rd_atomic_resources() then

alloc_rd_atomic_resources(), swapping qp->resp.resources[] while

rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources()

also leaves the cached pointer qp->resp.res dangling. A local

unprivileged user can race the free/realloc into a use-after-free in

rxe_receiver() (local DoS).

Drain recv_task around the swap with rxe_disable_task()/rxe_enable_task(),

as rxe_qp_reset() already does when tearing this array down, re-enabling

only after alloc_rd_atomic_resources() succeeds so the responder never

resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear

qp->resp.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References