CVE-2026-98366

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then validates the IB_MR_REREG_ACCESS argument: if (flags & IB_MR_REREG_PD) { rxe_put(old_pd); rxe_get(pd); mr->ibmr.pd = ibpd; } if (flags & IB_MR_REREG_ACCESS) { if (access & ~RXE_ACCESS_SUPPORTED_MR) return ERR_PTR(-EOPNOTSUPP); mr->access = access; } Both flags pass the entry check because RXE_MR_REREG_SUPPORTED is IB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access check with mr->ibmr.pd already reassigned. mr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the success path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error without undoing the reassignment, so mr->pd == new_pd while the usecnts still charge the MR to orig_pd. ib_dereg_mr_user() then decrements new_pd, whose count can reach zero while a memory window still references it; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup() writes to freed memory: BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0 Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591 __rxe_put+0x31/0xa0 rxe_mw_cleanup+0x42/0x200 __rxe_cleanup+0x115/0x370 rxe_dealloc_mw+0x4c/0x80 Allocated by task 591: ib_uverbs_alloc_pd+0x258/0x540 Freed by task 591: ib_dealloc_pd_user+0x174/0x210 uverbs_free_pd+0x8d/0xc0 ib_uverbs_dealloc_pd+0x18e/0x1d0 Validate the access flags before mutating any state so the callback either applies every requested change or none.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98366

EUVD

EUVD-2026-93351

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c
Linux	Linux	544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c
Linux	Linux	544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c
Linux	Linux	544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c
Linux	Linux	544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c
Linux	Linux	6.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of access flags in the RDMA subsystem. The function rxe_rereg_user_mr() reassigns a memory region's protection domain before validating the access flags, leading to a use-after-free condition. This occurs because the protection domain's reference count is not properly adjusted, causing it to be freed while still in use by a memory window.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA subsystem and may not have direct detection commands. Monitor kernel logs for slab-use-after-free errors or crashes in RDMA-related processes. Check for unexpected memory corruption or kernel panics involving rxe_mw_cleanup or __rxe_put functions.

Impact Analysis

This vulnerability can cause system instability, crashes, or potential privilege escalation. An attacker with local access could exploit this to trigger a use-after-free error, leading to kernel memory corruption. This may result in denial-of-service conditions or unauthorized access to sensitive data.

Compliance Impact

This vulnerability is a memory corruption issue in the Linux kernel's RDMA subsystem. It does not directly relate to data protection standards like GDPR or HIPAA, which focus on data privacy and security controls. The flaw could potentially lead to system instability or crashes, but there is no evidence it exposes or leaks sensitive data.

Mitigation Strategies

Apply the latest Linux kernel security updates. Disable RDMA functionality if not required. Restrict access to RDMA devices to trusted users only. Monitor for unusual activity in RDMA-related processes.

Hi! I’m here to help you understand CVE-2026-98366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70