Linux kernel - RDMA/rxe (Soft-RoCE) receive path, drivers/infiniband/sw/rxe/rxe_recv.c: FABRIC DOS: rxe_rcv() checked

Impact

FABRIC DOS: rxe_rcv() checked only that an inbound packet was at least header_size bytes, but payload_size() then subtracts the attacker-controlled BTH pad field and the ICRC size from the packet length. A short packet, or one carrying a forged non-zero pad, makes that subtraction underflow and hands a bogus length to everything downstream in the receive path. Since Soft-RoCE rides UDP/4791, a single unauthenticated datagram from anywhere that can reach the node crashes or corrupts the kernel - no connection, no handshake, no credentials. On a shared fabric one packet from one tenant takes down a GPU node and every job on it.

Who can reach it

Send a crafted UDP datagram to port 4791 on any host with rdma_rxe loaded. The BTH pad field is set by the attacker, so even a packet long enough to pass the header check can drive the payload length negative. Entirely pre-authentication and reachable from any source the network permits, including across routed segments if 4791 is not filtered.

What to do

Host reboot / kernel upgrade. Faster and cheaper: unload and blacklist rdma_rxe on every node that is not deliberately running Soft-RoCE (config change, zero downtime) - this closes the entire rxe family of remote packet bugs. If rxe is genuinely required, firewall UDP/4791 to known peers immediately as a stopgap, then upgrade the kernel on a rolling drain. Note the follow-on CVE-2026-46133 shows the first attempt at this fix was incomplete, so verify you are on a kernel carrying both.

References