CVE-2026-98365 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
A remote attacker can trigger an integer overflow in the Linux kernel RDMA module, causing an out-of-bounds access that leads to a kernel crash or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98365?
CVE-2026-98365 is a critical vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic:
if (iova < mr->ibmr.iova || iova + length > mr->ibmr.iova + mr->ibmr.length)
A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr->page_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer.
Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow:
if (iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length)
With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.
Which versions are affected by CVE-2026-98365?
How do I fix CVE-2026-98365?
Apply the vendor's patch.
Is CVE-2026-98365 being exploited?
There is no known exploitation of CVE-2026-98365 in the wild and no public exploit code.
Sources
Also known as AZL-106473, BELL-CVE-2026-98365, DEBIAN-CVE-2026-98365, GHSA-3p8h-wx5x-6qq3, UBUNTU-CVE-2026-98365.