RDMA/rxe: Fix a use-after-free problem in rxe_mmap
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_del_init(&ip->pending_mmaps); spin_unlock_bh(&rxe->pending_lock); /* ref == 1, no lock held */ ret = remap_vmalloc_range(vma, ip->obj, 0); /* walks PTEs */ [...] rxe_vma_open(vma); /* kref_get, ref → 2 */ remap_vmalloc_range_partial() walks PTEs without any lock. A concurrent DESTROY_CQ ioctl on another CPU calls: kref_put(&q->ip->ref, rxe_mmap_release) /* ref 1→0 */ vfree(ip->obj) /* clears vmalloc PTEs mid-walk */ kfree(ip) /* frees rxe_mmap_info */ This yields: 1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the per-PTE race -> vm_insert_page(NULL) → GPF in validate_page_before_insert 2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears it. User VMA holds a PTE to a free'd page which might eventually get reallocated later by vmalloc which allows the attacker to get a clean page-level UAF. It is worth noting that even though a page-level UAF is possible given the strong primitive, it is statistically very difficult to achieve given the very short time window (after the last insert_page and before the kref_get). The call trace are as below: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000
CVE-2026-64582
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-64582
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"lessThan": "b810352d0916796dabe633cdb9adee9863ab4911",
"versionType": "git"
},
{
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"lessThan": "aef5ea8578f97f2701039600846a8bcf5f21e863",
"versionType": "git"
},
{
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"lessThan": "3371f2036e0f970166bbb624e25bba46d32fa18e",
"versionType": "git"
},
{
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"lessThan": "665fb7d22a700c66a78db0cf88c6e6a649aba9d0",
"versionType": "git"
},
{
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"lessThan": "e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e",
"versionType": "git"
},
{
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"lessThan": "e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6",
"versionType": "git"
},
{
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"lessThan": "3525987a392536f31a484833af258971af63b24c",
"versionType": "git"
},
{
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"lessThan": "35744ab3d03c5fca8c1752f53fc8fc674e14c561",
"versionType": "git"
}
],
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mmap.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mmap.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-64582
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41099 · Revision 1
- Added to Heist Feed
- Publisher date