Linux kernel Soft-RoCE: modify_qp frees the rd_atomic array using the new size, writing out of bounds

Impact

rxe_qp_from_attr() updates qp->attr.max_dest_rd_atomic before freeing the old responder resource array, so free_rd_atomic_resources() iterates using the new, larger count and walks past the old allocation - KASAN reports a 4-byte slab out-of-bounds write reached from userspace through ib_uverbs_modify_qp. In a GPU cluster the uverbs device node is exactly what tenant pods are given when RDMA is exposed for NCCL, so the trigger is an ordinary queue-pair modify from an unprivileged process. This affects the Soft-RoCE software driver only; nodes using ConnectX/mlx5 hardware verbs without rdma_rxe loaded are not affected. A controlled slab out-of-bounds write is a memory-corruption primitive, but the record establishes only the KASAN crash, not working escalation.

Who can reach it

Local unprivileged user with access to an rxe RDMA device - an /dev/infiniband/uverbs* fd, which containers get when /dev/infiniband is mapped in. No authentication beyond that device access, and no path from the fabric wire.

What to do

Apply the stable kernel fix (linked commits) and reboot each affected node after draining it; the record names commits, not a fixed release. If a reboot cannot be scheduled, the exposure goes away by not loading the rdma_rxe module and not passing /dev/infiniband/uverbs* into tenant pods on Soft-RoCE hosts.

References

Related entries

• Linux kernel rdma_rxe: use-after-free in the responder task when modify_qp swaps the RD-atomic resource arrayCVE-2026-80864 · Linux kernel Soft-RoCE responder (rdma_rxe, IB_QP_MAX_DEST_RD_ATOMIC modify_qp)Unscored
• Linux kernel mlx5_ib: implicit ODP parent mkey re-registered in place, racing its child mkeys and mr->pdCVE-2026-80880 · Linux kernel mlx5_ib implicit ODP (rereg_mr on a parent mkey)Unscored
• Linux tpm_i2c_nuvoton: unbalanced enable_irq() on wait timeout can wedge TPM accessCVE-2026-80930 · Linux kernel tpm_i2c_nuvoton (TPM I2C driver IRQ balance)Unscored
• Linux kernel ipmi_msghandler: work item left scheduled when interface startup fails, freeing live stateCVE-2026-81004 · Linux kernel IPMI message handler (ipmi_msghandler interface startup error path)Unscored
• Linux kernel ipmi_si: NULL pointer dereference after a failed IPMI interface registrationCVE-2026-81005 · Linux kernel ipmi_si / ipmi_msghandler (failed BMC registration path)Unscored
• Linux kernel ipmi_msghandler: nr_msgs sysfs file survives a failed interface registrationCVE-2026-81006 · Linux kernel IPMI message handler (ipmi_add_smi sysfs attribute cleanup)Unscored