Riskcovery

CVE-2026-90423

RDMA/rxe: Fix UAF in ODP init error-handling path

State
Published
Severity
7.8 High
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix UAF in ODP init error-handling path

rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, rxe_odp_mr_init_user() releases umem_odp and returns an error.

rxe_reg_user_mr() then unwinds the error through rxe_cleanup(), rxe_mr_cleanup(), ib_umem_release(mr->umem). There is an IS_ERR_OR_NULL(umem) check at the start of ib_umem_release(). But since mr->umem is NOT reset to NULL in the error handling path of rxe_odp_mr_init_user(), the check passes and it reads already-freed fields like umem->is_dmabuf, causing UAF.

Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 to before 5f1933163327c9f1c8f2a341c6cb551aaf231ff9Affected
  • d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 to before 4cfb448705da3171d44d9cbe7be53ff03284d532Affected
  • d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 to before 51f2c8d2c99fc1f452f7113c08a35edcc4bf8732Affected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.