CVE-2026-98366

A slab-use-after-free vulnerability exists in the Linux kernel 's RDMA/rxe driver. The root cause is that the rxe_rereg_user_mr() function reassigns the memory region's protection domain (mr->ibmr.pd) before validating the IB_MR_REREG_ACCESS argument. If the access check fails, the function re...

CVE-2026-98365 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

CVE-2026-98365

The Linux kernel is vulnerable to an integer overflow in the mr_check_range() function within the RDMA/rxe component. The vulnerability exists because the function uses wraparound-prone arithmetic to validate that the iova and length fall within the registered Memory Region (MR) range. An unauthe...

EUVD-2026-93350

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

CVE-2026-98365

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

EUVD-2026-93346

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98361

The Linux kernel is vulnerable to a memory corruption issue in the RDMA/rxe driver due to the removal of the access permission test in rxe_check_pagefault(). This allows ODP write operations (such as RDMA WRITE , RDMA READ response , SEND payload , and atomics ) to modify read-only page-cache fol...

CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98361 RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98360 RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

CVE-2026-98360

The Linux kernel RDMA/rxe driver is vulnerable to a slab-use-after-free condition in the rxe_get_mcg() function. The root cause is that a newly allocated multicast group (mcg) is published to the rxe->mcg_tree before the backing Ethernet multicast address is successfully programmed via rxe_mca...

CVE-2026-98360

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

EUVD-2026-93345

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

EUVD-2026-93344

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

CVE-2026-98359 RDMA/core: Reject unregistering netdevs in ib_get_eth_speed

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

CVE-2026-98359

A vulnerability exists in the Linux kernel within the RDMA/core component. The function ib_device_get_netdev() returns a referenced net_device even during unregistration to maintain associations. However, ib_get_eth_speed() fails to verify the registration state before invoking its ethtool callba...

CVE-2026-98356

The Linux kernel contains a vulnerability in the RDMA/bnxt_re driver. Specifically, the function bnxt_re_init_dcb_wq() fails to properly handle a failed memory allocation. This oversight results in the asynchronous DCB handler subsequently calling queue_work() on a NULL pointer , which can lead t...

EUVD-2026-93341

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...

CVE-2026-98356

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...