Linux kernel RDMA/rxe: use-after-free when ODP memory-region registration fails

Impact

rxe_odp_mr_init_user() stores &umem_odp->umem into mr->umem before calling rxe_odp_init_pages(). If that call fails, the umem_odp is released but mr->umem is left dangling, so the unwind through rxe_reg_user_mr() -> rxe_cleanup() -> ib_umem_release() passes the IS_ERR_OR_NULL() guard and reads freed fields such as umem->is_dmabuf - a use-after-free on a failed memory-region registration (NVD: 7.8, local, full impact). A tenant that can make ODP page setup fail controls when the error path runs, which makes this more than a theoretical race. Exposure is confined to nodes running the rxe software RoCE provider with ODP in use; hardware RDMA stacks do not execute this code.

Who can reach it

Local, authenticated: a user or container holding an rxe uverbs device that registers an on-demand-paging memory region and drives the registration to failure. No remote vector described.

What to do

Patch to a stable kernel with the listed commits and reboot the node. Where soft-RoCE is not required, keeping the rdma_rxe module unloaded removes the exposure without a reboot and is the cheaper immediate step; also avoid exposing uverbs devices into tenant containers that do not need RDMA. No fixed vendor release is given in the record.

References

Related entries

• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High
• Linux AMD IOMMU: sign-discarding error check lets nested domains use an unallocated domain IDCVE-2026-98002 · Linux kernel iommu/amd (amd_iommu_alloc_domain_nested error check)High
• Linux kernel RDMA/rxe: ODP write paths accept read-only pages, letting RDMA traffic overwrite the page cacheCVE-2026-98361 · Linux kernel RDMA/rxe (soft-RoCE on-demand paging write path)High
• Linux kernel RDMA/rxe: MR re-registration swaps the PD before validating access flags, freeing a live PDCVE-2026-98366 · Linux kernel RDMA/rxe rxe_rereg_user_mr() (access-flag validation ordering)High