CVE-2026-46133

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Reject unknown opcodes before ICRC processing

Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC

before payload_size() in rxe_rcv"), a single unauthenticated UDP packet

can still trigger panic. That patch handled payload_size() underflow only

for valid opcodes with short packets, not for packets carrying an unknown

opcode. The unknown-opcode OOB read described below predates that commit

and reaches back to the initial Soft RoCE driver.

The check added there reads

pkt->paylen < header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE

where header_size(pkt) expands to rxe_opcode[pkt->opcode].length. The

rxe_opcode[] array has 256 entries but is only populated for defined IB

opcodes; any other entry (for example opcode 0xff) is zero-initialized, so

length == 0 and the check degenerates to

pkt->paylen < 0 + bth_pad(pkt) + RXE_ICRC_SIZE

which does not constrain pkt->paylen enough.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References