Description
In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix UAF in ODP init error-handling path

rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before
calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails,
rxe_odp_mr_init_user() releases umem_odp and returns an error.

rxe_reg_user_mr() then unwinds the error through rxe_cleanup(),
rxe_mr_cleanup(), ib_umem_release(mr->umem). There is an
IS_ERR_OR_NULL(umem) check at the start of ib_umem_release().
But since mr->umem is NOT reset to NULL in the error handling
path of rxe_odp_mr_init_user(), the check passes and it reads
already-freed fields like umem->is_dmabuf, causing UAF.

Fix the UAF by clearing mr->umem after releasing the failed
ODP umem so the MR cleanup path does not release it again.
Published: 2026-09-17
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Use‑After‑Free in RDMA driver that can lead to memory corruption or denial of service
Action: Patch immediately
AI Analysis

Impact

The kernel RDMA/rxe subsystem contains a use‑after‑free bug where the memory region pointer is stored before page initialization and not cleared on failure. If the page initialization fails, cleanup code later releases the already‑freed resource again, allowing the kernel to read freed memory and corrupt data. This flaw is a classic Use‑After‑Free condition and can cause unexpected kernel behavior or a crash.

Affected Systems

The vulnerability affects the Linux kernel, specifically the RDMA/rxe driver. No specific kernel releases or version ranges are listed in the information, so any kernel that includes this code path without the patch is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, but the EPSS is below 1%, suggesting a low probability of current exploitation. The flaw is not listed in CISA’s KEV catalog. Attackers would likely need local or elevated privileges to load code that exploits this kernel bug, but a successful exploit could crash the system or enable memory corruption. The attack vector is therefore inferred to be a local kernel exploitation scenario rather than a remote network attack.

Generated by OpenCVE AI on September 20, 2026 at 00:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a release that includes the committed fix (e.g., patch 4cfb448705da3171d44d9cbe7be53ff03284d532).
  • If a kernel upgrade is not immediately possible, apply the patch manually to the kernel source and rebuild the kernel or load the updated module.
  • Disable or unload the rxe kernel module until the patch is applied to prevent the use‑after‑free condition from being exercised.

Generated by OpenCVE AI on September 20, 2026 at 00:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 19 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 19 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, rxe_odp_mr_init_user() releases umem_odp and returns an error. rxe_reg_user_mr() then unwinds the error through rxe_cleanup(), rxe_mr_cleanup(), ib_umem_release(mr->umem). There is an IS_ERR_OR_NULL(umem) check at the start of ib_umem_release(). But since mr->umem is NOT reset to NULL in the error handling path of rxe_odp_mr_init_user(), the check passes and it reads already-freed fields like umem->is_dmabuf, causing UAF. Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again.
Title RDMA/rxe: Fix UAF in ODP init error-handling path
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-18T17:55:18.624Z

Reserved: 2026-09-11T19:38:34.814Z

Link: CVE-2026-90423

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:46.927

Modified: 2026-09-18T18:17:58.663

Link: CVE-2026-90423

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T00:45:16Z

Weaknesses