CVE-2026-46043

RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

State: Published
Severity: 9.1 Critical
Published: May 27, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used.

However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen:

payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE

This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users.

Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	8700e3e7c4857d28ebaa824509934556da0b3e76 to before c4376c672c3648d5bdc31dfffc329d07164f93c4Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 5fedefec757192dcaad29a664ac332c7601be144Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 2c0d71ef12f46c57d37bc571f3f2797db7eb50ccAffected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 2fd4f8b749309a61c3f3f88ee8891d94f79e1240Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before f83519a4c122c9c7a850a2197648a9ff4c67c520Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 9b924f3a26b21330a837cfe72e819b6393bbeeaaAffected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before e8ee0e792d475b1067c199ef0af1b6221fa6f43dAffected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 7244491dab347f648e661da96dc0febadd9daec3Affected
LinuxLinux	4.8Affected before 4.8Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.86 through 6.12.Not affected 6.18.27 through 6.18.Not affected 7.0.4 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

8700e3e7c4857d28ebaa824509934556da0b3e76 to before c4376c672c3648d5bdc31dfffc329d07164f93c4Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 5fedefec757192dcaad29a664ac332c7601be144Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 2c0d71ef12f46c57d37bc571f3f2797db7eb50ccAffected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 2fd4f8b749309a61c3f3f88ee8891d94f79e1240Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before f83519a4c122c9c7a850a2197648a9ff4c67c520Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 9b924f3a26b21330a837cfe72e819b6393bbeeaaAffected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before e8ee0e792d475b1067c199ef0af1b6221fa6f43dAffected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 7244491dab347f648e661da96dc0febadd9daec3Affected

LinuxLinux

4.8Affected
before 4.8Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.86 through 6.12.*Not affected
6.18.27 through 6.18.*Not affected
7.0.4 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.