Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE retransmit and ack timers race against queue-pair destruction

CVSS 7.8CVE-2026-45910Firmware, BMC & network fabriccurated

Impact

The soft-RoCE retransmit and ack timers race against queue-pair destruction: the QP refcount hits zero while a timer handler is still running and then schedules work on the freed object. That is a refcount underflow and use-after-free reachable without any special hardware.

Who can reach it

Any unprivileged process on a node with the rdma_rxe module loaded - soft-RoCE needs no HCA and is commonly available inside containers that were given RDMA access. The attacker creates a QP, keeps retransmit timers armed by stalling or dropping peer acknowledgements from the network side, and destroys the QP concurrently. A fabric peer can help by withholding acks.

What to do

No fixed version is listed in the record - take the stable kernel carrying 756c93d6df7c (or 3c2ae79fb19d / 5ae9da022ee3) and reboot. Interim: unload and blacklist rdma_rxe on nodes that do not actually need soft-RoCE; this removes the whole attack surface cheaply.

References

https://git.kernel.org/stable/c/756c93d6df7c3bc599f6590b8e5afead6a41de1c https://git.kernel.org/stable/c/3c2ae79fb19dfd67341c14f1e78a5f1744eacfe2 https://nvd.nist.gov/vuln/detail/CVE-2026-45910

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.