Skip to content
Heist/ feed
High

RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] For a user QP, qp->sq.queue is a ring the application writes directly, so rxe_post_send() takes the is_user branch and only schedules send_task without validating the WQE. rxe_requester() consumes it in place via req_next_wqe() and calls copy_data(), which indexes &wqe->dma.sge[cur_sge] with the attacker-controlled num_sge/cur_sge. Only the kernel path bounds num_sge (validate_send_wr()); the user WQE is never checked, so a local unprivileged user can post a WQE with an out-of-range cur_sge or oversized num_sge and force an out-of-bounds read of the per-WQE sge array in copy_data() (vmalloc OOB read, local DoS). Bound num_sge to qp->sq.max_sge in rxe_requester() before use, the way get_srq_wqe() already guards SRQ entries, and bound cur_sge only when the WQE carries payload (dma.resid): copy_data() returns early on a zero-length copy before touching dma->sge[], so a zero-payload WQE -- the only kind a max_sge == 0 QP can post -- stays valid. Reproduced under KASAN; the vmalloc-out-of-bounds in copy_data() is gone.

Announced Source revision 1
Original source ↗

CVE-2026-92525

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92525

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
        "lessThan": "69d3ccf6543f24c452a020c8028ca6f46cb1e8db",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
        "lessThan": "750bba6ce9bb0b11d6a166031c9728ae3f21765e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
        "lessThan": "c067aa7b231e91a18a1b3666201ab14dfb00347a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
        "lessThan": "13cb7160e5b791f5e3ecf9311cf32849fe7e9b62",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
        "lessThan": "5ec111ddc1f727c1e4580aea459842ae5a8359a5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
        "lessThan": "126c757e4cd46f866ddc283143b58eb4d9bf52cd",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/infiniband/sw/rxe/rxe_req.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.8"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.8",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.110",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.52",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/infiniband/sw/rxe/rxe_req.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-92525

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#37775 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement