CVE-2026-46325 (GCVE-0-2026-46325)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:25 – Updated: 2026-08-05 12:31
VLAI
Title
RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 592627ccbdff0ec6fff00fc761142a76db750dd4 , < 409c2c5508f3d30627bea576f8676de523cb906e (git)
Affected: 592627ccbdff0ec6fff00fc761142a76db750dd4 , < 836f6c13c9674027793f720be3f15ecd2b90b6ca (git)
Affected: 592627ccbdff0ec6fff00fc761142a76db750dd4 , < 12985e5915a0b8354796efadaaeb201eed115377 (git)
Affected: 0e443760b8b7b1e6723f4408afa056b2bc4fea12 (git)
Affected: 6.2.3 , < 6.3 (semver)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_mr.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "409c2c5508f3d30627bea576f8676de523cb906e",
              "status": "affected",
              "version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
              "versionType": "git"
            },
            {
              "lessThan": "836f6c13c9674027793f720be3f15ecd2b90b6ca",
              "status": "affected",
              "version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
              "versionType": "git"
            },
            {
              "lessThan": "12985e5915a0b8354796efadaaeb201eed115377",
              "status": "affected",
              "version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0e443760b8b7b1e6723f4408afa056b2bc4fea12",
              "versionType": "git"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_mr.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE\n\nThe current implementation incorrectly handles memory regions (MRs) with\npage sizes different from the system PAGE_SIZE. The core issue is that\nrxe_set_page() is called with mr-\u003epage_size step increments, but the\npage_list stores individual struct page pointers, each representing\nPAGE_SIZE of memory.\n\nib_sg_to_page() has ensured that when i\u003e=1 either\na) SG[i-1].dma_end and SG[i].dma_addr are contiguous\nor\nb) SG[i-1].dma_end and SG[i].dma_addr are mr-\u003epage_size aligned.\n\nThis leads to incorrect iova-to-va conversion in scenarios:\n\n1) page_size \u003c PAGE_SIZE (e.g., MR: 4K, system: 64K):\n   ibmr-\u003eiova = 0x181800\n   sg[0]: dma_addr=0x181800, len=0x800\n   sg[1]: dma_addr=0x173000, len=0x1000\n\n   Access iova = 0x181800 + 0x810 = 0x182010\n   Expected VA: 0x173010 (second SG, offset 0x10)\n   Before fix:\n     - index = (0x182010 \u003e\u003e 12) - (0x181800 \u003e\u003e 12) = 1\n     - page_offset = 0x182010 \u0026 0xFFF = 0x10\n     - xarray[1] stores system page base 0x170000\n     - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)\n\n2) page_size \u003e PAGE_SIZE (e.g., MR: 64K, system: 4K):\n   ibmr-\u003eiova = 0x18f800\n   sg[0]: dma_addr=0x18f800, len=0x800\n   sg[1]: dma_addr=0x170000, len=0x1000\n\n   Access iova = 0x18f800 + 0x810 = 0x190010\n   Expected VA: 0x170010 (second SG, offset 0x10)\n   Before fix:\n     - index = (0x190010 \u003e\u003e 16) - (0x18f800 \u003e\u003e 16) = 1\n     - page_offset = 0x190010 \u0026 0xFFFF = 0x10\n     - xarray[1] stores system page for dma_addr 0x170000\n     - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)\n\nYi Zhang reported a kernel panic[1] years ago related to this defect.\n\nSolution:\n1. Replace xarray with pre-allocated rxe_mr_page array for sequential\n   indexing (all MR page indices are contiguous)\n2. Each rxe_mr_page stores both struct page* and offset within the\n   system page\n3. Handle MR page_size != PAGE_SIZE relationships:\n   - page_size \u003e PAGE_SIZE: Split MR pages into multiple system pages\n   - page_size \u003c= PAGE_SIZE: Store offset within system page\n4. Add boundary checks and compatibility validation\n\nThis ensures correct iova-to-va conversion regardless of MR page size\nand system PAGE_SIZE relationship, while improving performance through\narray-based sequential access.\n\nTests on 4K and 64K PAGE_SIZE hosts:\n- rdma-core/pytests\n  $ ./build/bin/run_tests.py  --dev eth0_rxe\n- blktest:\n  $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd\n\n[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when rxe processes incoming RoCE packets over UDP (port 4791) on the responder path for RDMA Read, Write, and Atomic operations, which is the standard network-facing deployment for software RoCE storage targets and RDMA services.\nAC:L - Once a victim host runs rxe with an FMR whose page_size differs from PAGE_SIZE, a remote peer can reliably trigger the defective iova-to-VA conversion by sending RDMA operations with IOVAs that cross MR page boundaries, as demonstrated in the fix commit\u0027s worked examples.\nPR:N - Exploitation requires no OS privileges on the victim host; a remote attacker only needs network reachability to an established RDMA session (e.g., NVMe-oF or rtrs client) and a valid rkey from that connection, not local root or CAP_NET_ADMIN on the target system.\nUI:N - No victim user action is required beyond normal operation of an RDMA-connected service; the attacker triggers the flaw by sending crafted RDMA packets over an existing queue pair.\nS:U - Impact is confined to kernel memory corruption and crashes within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Incorrect iova-to-VA mapping causes memcpy and atomic handlers to read from the wrong struct page, enabling disclosure of data from unintended pages within the MR mapping and constituting out-of-bounds kernel memory read.\nI:H - RDMA Write and Atomic Write operations using the buggy conversion write to incorrectly resolved virtual addresses, corrupting kernel memory outside the intended MR buffer and providing a memory-corruption primitive exploitable for further compromise.\nA:H - The fix commit cites a confirmed kernel panic from this defect, and misresolved page mappings in rxe_mr_copy() can cause oopses or crashes when accessing invalid or misaligned memory."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:20.551Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/409c2c5508f3d30627bea576f8676de523cb906e"
        },
        {
          "url": "https://git.kernel.org/stable/c/836f6c13c9674027793f720be3f15ecd2b90b6ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/12985e5915a0b8354796efadaaeb201eed115377"
        }
      ],
      "title": "RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46325",
    "datePublished": "2026-06-09T12:25:52.792Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-08-05T12:31:20.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46325",
      "date": "2026-08-15",
      "epss": "0.00347",
      "percentile": "0.27808"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:03:12.000Z",
      "cve": "CVE-2026-46325",
      "id": "msrc_CVE-2026-46325",
      "initial_release_date": "2026-06-10T01:06:20.000Z",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46325.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46325\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-09T14:16:42.177\",\"lastModified\":\"2026-07-23T08:10:00.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE\\n\\nThe current implementation incorrectly handles memory regions (MRs) with\\npage sizes different from the system PAGE_SIZE. The core issue is that\\nrxe_set_page() is called with mr-\u003epage_size step increments, but the\\npage_list stores individual struct page pointers, each representing\\nPAGE_SIZE of memory.\\n\\nib_sg_to_page() has ensured that when i\u003e=1 either\\na) SG[i-1].dma_end and SG[i].dma_addr are contiguous\\nor\\nb) SG[i-1].dma_end and SG[i].dma_addr are mr-\u003epage_size aligned.\\n\\nThis leads to incorrect iova-to-va conversion in scenarios:\\n\\n1) page_size \u003c PAGE_SIZE (e.g., MR: 4K, system: 64K):\\n   ibmr-\u003eiova = 0x181800\\n   sg[0]: dma_addr=0x181800, len=0x800\\n   sg[1]: dma_addr=0x173000, len=0x1000\\n\\n   Access iova = 0x181800 + 0x810 = 0x182010\\n   Expected VA: 0x173010 (second SG, offset 0x10)\\n   Before fix:\\n     - index = (0x182010 \u003e\u003e 12) - (0x181800 \u003e\u003e 12) = 1\\n     - page_offset = 0x182010 \u0026 0xFFF = 0x10\\n     - xarray[1] stores system page base 0x170000\\n     - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)\\n\\n2) page_size \u003e PAGE_SIZE (e.g., MR: 64K, system: 4K):\\n   ibmr-\u003eiova = 0x18f800\\n   sg[0]: dma_addr=0x18f800, len=0x800\\n   sg[1]: dma_addr=0x170000, len=0x1000\\n\\n   Access iova = 0x18f800 + 0x810 = 0x190010\\n   Expected VA: 0x170010 (second SG, offset 0x10)\\n   Before fix:\\n     - index = (0x190010 \u003e\u003e 16) - (0x18f800 \u003e\u003e 16) = 1\\n     - page_offset = 0x190010 \u0026 0xFFFF = 0x10\\n     - xarray[1] stores system page for dma_addr 0x170000\\n     - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)\\n\\nYi Zhang reported a kernel panic[1] years ago related to this defect.\\n\\nSolution:\\n1. Replace xarray with pre-allocated rxe_mr_page array for sequential\\n   indexing (all MR page indices are contiguous)\\n2. Each rxe_mr_page stores both struct page* and offset within the\\n   system page\\n3. Handle MR page_size != PAGE_SIZE relationships:\\n   - page_size \u003e PAGE_SIZE: Split MR pages into multiple system pages\\n   - page_size \u003c= PAGE_SIZE: Store offset within system page\\n4. Add boundary checks and compatibility validation\\n\\nThis ensures correct iova-to-va conversion regardless of MR page size\\nand system PAGE_SIZE relationship, while improving performance through\\narray-based sequential access.\\n\\nTests on 4K and 64K PAGE_SIZE hosts:\\n- rdma-core/pytests\\n  $ ./build/bin/run_tests.py  --dev eth0_rxe\\n- blktest:\\n  $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd\\n\\n[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nRDMA/rxe: Correcci\u00f3n de la conversi\u00f3n iova-a-va para tama\u00f1os de p\u00e1gina de MR != PAGE_SIZE\\n\\nLa implementaci\u00f3n actual maneja incorrectamente las regiones de memoria (MRs) con tama\u00f1os de p\u00e1gina diferentes al PAGE_SIZE del sistema. El problema central es que rxe_set_page() se llama con incrementos de paso mr-\u003epage_size, pero la page_list almacena punteros individuales a struct page, cada uno representando PAGE_SIZE de memoria.\\n\\nib_sg_to_page() ha asegurado que cuando i\u003e=1, o bien a) SG[i-1].dma_end y SG[i].dma_addr son contiguos o b) SG[i-1].dma_end y SG[i].dma_addr est\u00e1n alineados con mr-\u003epage_size.\\n\\nEsto lleva a una conversi\u00f3n iova-a-va incorrecta en los siguientes escenarios:\\n\\n1) page_size \u003c PAGE_SIZE (ej., MR: 4K, sistema: 64K):\\n   ibmr-\u003eiova = 0x181800\\n   sg[0]: dma_addr=0x181800, len=0x800\\n   sg[1]: dma_addr=0x173000, len=0x1000\\n\\n   Acceso iova = 0x181800 + 0x810 = 0x182010\\n   VA esperada: 0x173010 (segundo SG, desplazamiento 0x10)\\n   Antes de la correcci\u00f3n:\\n     - \u00edndice = (0x182010 \u003e\u003e 12) - (0x181800 \u003e\u003e 12) = 1\\n     - page_offset = 0x182010 \u0026 0xFFF = 0x10\\n     - xarray[1] almacena la base de p\u00e1gina del sistema 0x170000\\n     - VA resultante: 0x170000 + 0x10 = 0x170010 (incorrecto)\\n\\n2) page_size \u003e PAGE_SIZE (ej., MR: 64K, sistema: 4K):\\n   ibmr-\u003eiova = 0x18f800\\n   sg[0]: dma_addr=0x18f800, len=0x800\\n   sg[1]: dma_addr=0x170000, len=0x1000\\n\\n   Acceso iova = 0x18f800 + 0x810 = 0x190010\\n   VA esperada: 0x170010 (segundo SG, desplazamiento 0x10)\\n   Antes de la correcci\u00f3n:\\n     - \u00edndice = (0x190010 \u003e\u003e 16) - (0x18f800 \u003e\u003e 16) = 1\\n     - page_offset = 0x190010 \u0026 0xFFFF = 0x10\\n     - xarray[1] almacena la p\u00e1gina del sistema para dma_addr 0x170000\\n     - VA resultante: p\u00e1gina del sistema de 0x170000 + 0x10 = 0x170010 (incorrecto)\\n\\nYi Zhang inform\u00f3 de un kernel panic[1] hace a\u00f1os relacionado con este defecto.\\n\\nSoluci\u00f3n:\\n1. Reemplazar xarray con un array rxe_mr_page preasignado para indexaci\u00f3n secuencial (todos los \u00edndices de p\u00e1gina de MR son contiguos)\\n2. Cada rxe_mr_page almacena tanto struct page como el desplazamiento dentro de la p\u00e1gina del sistema\\n3. Manejar las relaciones MR page_size != PAGE_SIZE:\\n   - page_size \u003e PAGE_SIZE: Dividir las p\u00e1ginas de MR en m\u00faltiples p\u00e1ginas del sistema\\n   - page_size \u003c= PAGE_SIZE: Almacenar el desplazamiento dentro de la p\u00e1gina del sistema\\n4. A\u00f1adir comprobaciones de l\u00edmites y validaci\u00f3n de compatibilidad\\n\\nEsto asegura una conversi\u00f3n iova-a-va correcta independientemente del tama\u00f1o de p\u00e1gina de MR y la relaci\u00f3n PAGE_SIZE del sistema, al tiempo que mejora el rendimiento mediante el acceso secuencial basado en arrays.\\n\\nPruebas en hosts con PAGE_SIZE de 4K y 64K:\\n- rdma-core/pytests\\n  $ ./build/bin/run_tests.py  --dev eth0_rxe\\n- blktest:\\n  $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd\\n\\n[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/sw/rxe/rxe_mr.c\",\"drivers/infiniband/sw/rxe/rxe_verbs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"592627ccbdff0ec6fff00fc761142a76db750dd4\",\"lessThan\":\"409c2c5508f3d30627bea576f8676de523cb906e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"592627ccbdff0ec6fff00fc761142a76db750dd4\",\"lessThan\":\"836f6c13c9674027793f720be3f15ecd2b90b6ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"592627ccbdff0ec6fff00fc761142a76db750dd4\",\"lessThan\":\"12985e5915a0b8354796efadaaeb201eed115377\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e443760b8b7b1e6723f4408afa056b2bc4fea12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.2.3\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/sw/rxe/rxe_mr.c\",\"drivers/infiniband/sw/rxe/rxe_verbs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.3\",\"versionEndExcluding\":\"6.18.14\",\"matchCriteriaId\":\"372F28D4-9F28-4024-B964-DE55031C23BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"672A3E79-EC03-479D-8503-361DFBDC8092\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12985e5915a0b8354796efadaaeb201eed115377\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/409c2c5508f3d30627bea576f8676de523cb906e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/836f6c13c9674027793f720be3f15ecd2b90b6ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:40:55+00:00",
      "cve": "CVE-2026-46325",
      "id": "CVE-2026-46325",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46325.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-03T23:38:20Z",
      "cve": "CVE-2026-46325",
      "id": "CVE-2026-46325",
      "initial_release_date": "2026-06-10T02:25:44Z",
      "product_status:known_affected": "97",
      "product_status:known_not_affected": "181",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46325",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46325.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.