CVE-2026-98365

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

mr_check_range() validates that [iova, iova+length) falls within the

registered MR range using wraparound-prone arithmetic:

if (iova < mr->ibmr.iova ||

iova + length > mr->ibmr.iova + mr->ibmr.length)

A remote peer can craft an RDMA-Write/Read RETH so that iova + length

wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the

check. rxe_mr_iova_to_index() then computes a huge index (int idx, only

guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences

mr->page_info[huge], causing an out-of-bounds read/write and a kernel

oops that is triggerable by an unauthenticated remote peer.

Rewrite the check in overflow-safe form; the first two clauses guarantee

that the subsequent subtractions do not underflow:

if (iova < mr->ibmr.iova ||

length > mr->ibmr.length ||

iova - mr->ibmr.iova > mr->ibmr.length - le

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References