CVE-2026-98366

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: validate access flags before swapping the MR's PD

rxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then

validates the IB_MR_REREG_ACCESS argument:

if (flags & IB_MR_REREG_PD) {

rxe_put(old_pd);

rxe_get(pd);

mr->ibmr.pd = ibpd;

}

if (flags & IB_MR_REREG_ACCESS) {

if (access & ~RXE_ACCESS_SUPPORTED_MR)

return ERR_PTR(-EOPNOTSUPP);

mr->access = access;

}

Both flags pass the entry check because RXE_MR_REREG_SUPPORTED is

IB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access

check with mr->ibmr.pd already reassigned.

mr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the

success path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error

without undoing the reassignment, so mr->pd == new_pd while the usecnts

still charge the MR to orig_pd. ib_dereg_mr_user() then decrements

new_pd, whose count can reach zero while a memory window still references

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References