CVE-2026-98365

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic: if (iova < mr->ibmr.iova || iova + length > mr->ibmr.iova + mr->ibmr.length) A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr->page_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer. Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow: if (iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length) With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98365

EUVD

EUVD-2026-93350

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	8700e3e7c4857d28ebaa824509934556da0b3e76
Linux	Linux	8700e3e7c4857d28ebaa824509934556da0b3e76
Linux	Linux	8700e3e7c4857d28ebaa824509934556da0b3e76
Linux	Linux	8700e3e7c4857d28ebaa824509934556da0b3e76
Linux	Linux	8700e3e7c4857d28ebaa824509934556da0b3e76
Linux	Linux	4.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's RDMA subsystem. It involves an integer overflow in the mr_check_range() function that allows an out-of-bounds memory access. A remote attacker can craft a specific RDMA request to bypass validation checks, leading to kernel memory corruption and a system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA subsystem and requires kernel-level detection. Check if your kernel version includes the vulnerable mr_check_range() function by examining kernel logs for OOB access errors or kernel oops related to RDMA operations. Monitor for remote peer-triggered crashes or memory corruption events.

Impact Analysis

An unauthenticated remote attacker could exploit this to crash the affected system, causing a denial of service. The vulnerability allows memory corruption which could potentially lead to arbitrary code execution, though this requires further exploitation.

Compliance Impact

This vulnerability allows unauthenticated remote peers to trigger kernel oopses via out-of-bounds memory access in the Linux kernel's RDMA subsystem. While not directly tied to data exfiltration or confidentiality breaches, such instability could disrupt systems handling sensitive data, potentially violating availability requirements in GDPR or HIPAA.

Mitigation Strategies

Apply the latest kernel security patches that include the fix for CVE-2026-98365. If immediate patching is not possible, disable the RDMA RXE driver (rxe) by blacklisting the module or restricting network access to RDMA services until patched.

Hi! I’m here to help you understand CVE-2026-98365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70