CVE-2026-46114 RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
A remote attacker can leak kernel memory by sending malformed RDMA ATOMIC_WRITE requests with zero-length payloads, exposing sensitive kernel data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46114?
CVE-2026-46114 is a high-severity vulnerability in Linux kernel, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt):
value = *(u64 *)payload_addr(pkt);
check_rkey() previously accepted an ATOMIC_WRITE request with pktlen == resid == 0 because the length validation only compared pktlen against resid. A remote initiator that sets the RETH length to 0 therefore reaches atomic_write_reply() with a zero-byte logical payload, and the responder reads sizeof(u64) bytes from past the logical end of the packet into skb->head tailroom, then writes those 8 bytes into the attacker's MR via rxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel tailroom per probe (the other 4 bytes are the packet's own trailing ICRC).
IBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is protocol-invalid. Hoist a strict length check into check_rkey() so the responder never reaches the unchecked dereference, and keep the existing WRITE-family length logic for the normal RDMA WRITE path.
Reproduced on mainline with an unmodified rxe driver: a sustained zero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer bytes into the attacker's MR, including recognisable kernel strings and partial kernel-direct-map pointer words. With this patch applied the responder rejects the PDU and the MR stays all-zero.
Which versions are affected by CVE-2026-46114?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46114?
Apply the vendor's patch.
Is CVE-2026-46114 being exploited?
There is no known exploitation of CVE-2026-46114 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-89115, BELL-CVE-2026-46114, DEBIAN-CVE-2026-46114, GHSA-pv35-9gqp-7q2c, ROOT-OS-UBUNTU-2404-CVE-2026-46114, UBUNTU-CVE-2026-46114.