CVE-2026-46133

Technical summary

CVE-2026-46133 is an out-of-bounds read vulnerability in the Linux kernel's RDMA/rxe (Soft RoCE) driver, specifically in the rxe_rcv() function and related packet processing logic. The flaw occurs when processing packets with unknown or undefined opcodes. The driver maintains an rxe_opcode[] array with 256 entries, but only valid InfiniBand opcodes are populated; undefined opcodes result in zero-initialized entries. When validating packet length before ICRC (Internet Checksum) processing, the code checks: pkt->paylen < header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE. For unknown opcodes where header_size returns 0, this check becomes insufficient and allows undersized packets through. Subsequently, rxe_icrc_hdr() computes rxe_opcode[pkt->opcode].length - RXE_BTH_BYTES, which underflows to a huge unsigned value when length is 0. This underflowed value is passed to rxe_crc32(), causing it to read far beyond the allocated skb (socket buffer) payload, triggering a slab-out-of-bounds read detected by KASAN. Subsequent packets with the same malformed shape can fault on unmapped memory and panic the kernel.

Business impact

This vulnerability enables a denial-of-service attack against systems running the RDMA/rxe driver, which is used for software-based RDMA over Ethernet. Affected organizations may experience unplanned kernel panics and service outages if systems are directly exposed to untrusted networks. The attack requires only that the rxe module is loaded and an RDMA interface is configured—no active RDMA connections or authentication are needed. For data center operators, storage vendors, and high-performance computing environments using Soft RoCE for clustering or network storage, this represents a critical availability risk. The ease of exploitation (a single 48-byte packet) and lack of prerequisites make this a high-priority denial-of-service vector.

Affected systems

Linux kernel systems with CONFIG_RDMA_RXE enabled (the Soft RoCE driver). The vulnerability affects the kernel's RDMA/rxe subsystem and requires that the rxe kernel module is loaded and an RDMA link is configured. Any Linux distribution or embedded system shipping a kernel with Soft RoCE support and accessible RDMA networking is potentially affected. The vulnerability was introduced early in the Soft RoCE driver's history and persists even after prior patch attempts (commit 7244491dab34) that addressed related but incomplete validation logic.

Exploitability

Exploitability is high. The attack is trivial to execute: an attacker with network access to a system's RDMA UDP port (default 4791) can send a single 48-byte packet with opcode 0xff and QPN set to IB_MULTICAST_QPN to trigger an immediate kernel panic. No authentication, no prior connection, and no user interaction are required. The vulnerability exists in the kernel's receive path before any credential checks, making it reachable from any untrusted network segment with UDP connectivity. CVSS 3.1 score is 7.5 (High) reflecting the network-adjacent attack vector, low complexity, lack of privileges required, and assured availability impact.

Remediation

Apply kernel patches that implement opcode validation before length arithmetic and ICRC processing. The fix involves explicitly checking whether a packet's opcode has a valid entry in the rxe_opcode[] array (via zero mask or zero length check) and rejecting packets with unknown opcodes early in rxe_rcv() before header_size() is used in any length calculation. Verify against the vendor advisory and Linux kernel commit history for the specific version deployed in your environment. Systems unable to immediately patch should disable CONFIG_RDMA_RXE at build time or unload the rxe module if it is not in use. For RDMA environments, network-level access controls restricting UDP port 4791 to trusted sources provide temporary mitigation.

Patch guidance

Update the Linux kernel to a version containing the fix for CVE-2026-46133. Refer to kernel.org, your Linux distribution's security advisories, and the specific vendor advisory for patch version details. The fix typically involves adding an early opcode validity check in rxe_rcv() to reject packets with undefined opcodes before header_size() or other length-dependent operations execute. After patching, reboot systems to load the updated kernel. For systems where Soft RoCE is not actively used, consider disabling the rxe module or rebuilding the kernel without CONFIG_RDMA_RXE to eliminate exposure entirely. Verify patches are applied via kernel version checks and monitoring for rxe module behavior changes.

Detection guidance

Monitor for kernel panics, KASAN slab-out-of-bounds warnings, and crc32_le out-of-bounds read errors in kernel logs, particularly on systems with CONFIG_RDMA_RXE enabled. Configure kernel logging and crash dump analysis to capture stack traces showing rxe_rcv, rxe_icrc_hdr, or crc32_le in the call path. Network-level detection is challenging without deep packet inspection, but IDS/IPS systems can be tuned to flag UDP traffic to port 4791 with unusual packet sizes (e.g., <64 bytes) or invalid InfiniBand opcodes. For proactive detection, enable KASAN on test systems to surface the vulnerability before production impact. Host-based monitoring should alert on unexpected kernel panics or module crashes on systems where RDMA is in use.

Why prioritize this

Despite not being on the KEV catalog, this vulnerability merits immediate prioritization due to its high exploitability, trivial attack execution, complete lack of prerequisites, and severe impact (reliable kernel panic). The 48-byte packet trigger is extraordinarily simple to weaponize. Organizations with Soft RoCE deployments or Linux systems with CONFIG_RDMA_RXE should treat this as a critical availability threat. The vulnerability is also longstanding (present since the driver's inception), increasing the likelihood it exists in many production kernels. Patching should proceed in parallel with network segmentation and module disable measures.

Risk score, explained

CVSS 3.1 Base Score 7.5 (High) reflects: AV:N (network-adjacent attack from any host with UDP connectivity to port 4791), AC:L (low complexity; single packet, no timing or race conditions), PR:N (no privileges required; unauthenticated), UI:N (no user interaction), S:U (impact isolated to the affected host's kernel), C:N (no confidentiality impact), I:N (no integrity impact), and A:H (high availability impact via reliable denial of service/kernel panic). The score does not reflect KEV status, but environmental factors such as direct internet exposure of RDMA services, lack of network segmentation, or critical system role would elevate organizational risk.

Frequently asked questions