CVE-2026-80864
Received Received - Intake

Use-After-Free in Linux Kernel RDMA/rxe Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while the responder task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting only that attribute calls free_rd_atomic_resources() then alloc_rd_atomic_resources(), swapping qp->resp.resources[] while rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources() also leaves the cached pointer qp->resp.res dangling. A local unprivileged user can race the free/realloc into a use-after-free in rxe_receiver() (local DoS). Drain recv_task around the swap with rxe_disable_task()/rxe_enable_task(), as rxe_qp_reset() already does when tearing this array down, re-enabling only after alloc_rd_atomic_resources() succeeds so the responder never resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear qp->resp.res in free_rd_atomic_resources(), like the rxe_resp.c completion paths. Reproduced under KASAN; the slab-use-after-free in rxe_receiver() is gone.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80864
EUVD
EUVD-2026-71314

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RDMA/rxe driver. It occurs when modifying the IB_QP_MAX_DEST_RD_ATOMIC attribute of a queue pair (QP) without proper synchronization. A local unprivileged user can exploit a race condition to trigger a use-after-free in the responder task, leading to a local denial of service.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA subsystem and requires kernel-level detection. There are no direct network or system commands to detect this CVE-2026-80864. The issue involves a use-after-free in the RDMA rxe driver, which may be detected through kernel logs or KASAN (Kernel Address Sanitizer) output if enabled. Check for kernel oops, crashes, or slab corruption messages in system logs.

Impact Analysis

This vulnerability allows a local attacker to crash the system by causing a use-after-free in the kernel's RDMA subsystem. This results in a denial of service, potentially disrupting services relying on RDMA functionality.

Compliance Impact

This vulnerability is a local denial-of-service issue in the Linux kernel's RDMA subsystem. It does not directly relate to data privacy, access controls, or audit logging required by standards like GDPR or HIPAA. Compliance impact would be indirect if the DoS disrupts systems handling regulated data.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this use-after-free vulnerability in the RDMA/rxe driver.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80864. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart