CVE-2026-46325 (GCVE-0-2026-46325)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:25 – Updated: 2026-06-14 04:30
VLAI
Title
RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 592627ccbdff0ec6fff00fc761142a76db750dd4 , < 409c2c5508f3d30627bea576f8676de523cb906e (git)
Affected: 592627ccbdff0ec6fff00fc761142a76db750dd4 , < 836f6c13c9674027793f720be3f15ecd2b90b6ca (git)
Affected: 592627ccbdff0ec6fff00fc761142a76db750dd4 , < 12985e5915a0b8354796efadaaeb201eed115377 (git)
Affected: 0e443760b8b7b1e6723f4408afa056b2bc4fea12 (git)
Affected: 6.2.3 , < 6.3 (semver)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_mr.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "409c2c5508f3d30627bea576f8676de523cb906e",
              "status": "affected",
              "version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
              "versionType": "git"
            },
            {
              "lessThan": "836f6c13c9674027793f720be3f15ecd2b90b6ca",
              "status": "affected",
              "version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
              "versionType": "git"
            },
            {
              "lessThan": "12985e5915a0b8354796efadaaeb201eed115377",
              "status": "affected",
              "version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0e443760b8b7b1e6723f4408afa056b2bc4fea12",
              "versionType": "git"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_mr.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE\n\nThe current implementation incorrectly handles memory regions (MRs) with\npage sizes different from the system PAGE_SIZE. The core issue is that\nrxe_set_page() is called with mr-\u003epage_size step increments, but the\npage_list stores individual struct page pointers, each representing\nPAGE_SIZE of memory.\n\nib_sg_to_page() has ensured that when i\u003e=1 either\na) SG[i-1].dma_end and SG[i].dma_addr are contiguous\nor\nb) SG[i-1].dma_end and SG[i].dma_addr are mr-\u003epage_size aligned.\n\nThis leads to incorrect iova-to-va conversion in scenarios:\n\n1) page_size \u003c PAGE_SIZE (e.g., MR: 4K, system: 64K):\n   ibmr-\u003eiova = 0x181800\n   sg[0]: dma_addr=0x181800, len=0x800\n   sg[1]: dma_addr=0x173000, len=0x1000\n\n   Access iova = 0x181800 + 0x810 = 0x182010\n   Expected VA: 0x173010 (second SG, offset 0x10)\n   Before fix:\n     - index = (0x182010 \u003e\u003e 12) - (0x181800 \u003e\u003e 12) = 1\n     - page_offset = 0x182010 \u0026 0xFFF = 0x10\n     - xarray[1] stores system page base 0x170000\n     - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)\n\n2) page_size \u003e PAGE_SIZE (e.g., MR: 64K, system: 4K):\n   ibmr-\u003eiova = 0x18f800\n   sg[0]: dma_addr=0x18f800, len=0x800\n   sg[1]: dma_addr=0x170000, len=0x1000\n\n   Access iova = 0x18f800 + 0x810 = 0x190010\n   Expected VA: 0x170010 (second SG, offset 0x10)\n   Before fix:\n     - index = (0x190010 \u003e\u003e 16) - (0x18f800 \u003e\u003e 16) = 1\n     - page_offset = 0x190010 \u0026 0xFFFF = 0x10\n     - xarray[1] stores system page for dma_addr 0x170000\n     - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)\n\nYi Zhang reported a kernel panic[1] years ago related to this defect.\n\nSolution:\n1. Replace xarray with pre-allocated rxe_mr_page array for sequential\n   indexing (all MR page indices are contiguous)\n2. Each rxe_mr_page stores both struct page* and offset within the\n   system page\n3. Handle MR page_size != PAGE_SIZE relationships:\n   - page_size \u003e PAGE_SIZE: Split MR pages into multiple system pages\n   - page_size \u003c= PAGE_SIZE: Store offset within system page\n4. Add boundary checks and compatibility validation\n\nThis ensures correct iova-to-va conversion regardless of MR page size\nand system PAGE_SIZE relationship, while improving performance through\narray-based sequential access.\n\nTests on 4K and 64K PAGE_SIZE hosts:\n- rdma-core/pytests\n  $ ./build/bin/run_tests.py  --dev eth0_rxe\n- blktest:\n  $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd\n\n[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T04:30:21.581Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/409c2c5508f3d30627bea576f8676de523cb906e"
        },
        {
          "url": "https://git.kernel.org/stable/c/836f6c13c9674027793f720be3f15ecd2b90b6ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/12985e5915a0b8354796efadaaeb201eed115377"
        }
      ],
      "title": "RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46325",
    "datePublished": "2026-06-09T12:25:52.792Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-06-14T04:30:21.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46325",
      "date": "2026-07-05",
      "epss": "0.00347",
      "percentile": "0.26745"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46325\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-09T14:16:42.177\",\"lastModified\":\"2026-06-17T10:53:34.073\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE\\n\\nThe current implementation incorrectly handles memory regions (MRs) with\\npage sizes different from the system PAGE_SIZE. The core issue is that\\nrxe_set_page() is called with mr-\u003epage_size step increments, but the\\npage_list stores individual struct page pointers, each representing\\nPAGE_SIZE of memory.\\n\\nib_sg_to_page() has ensured that when i\u003e=1 either\\na) SG[i-1].dma_end and SG[i].dma_addr are contiguous\\nor\\nb) SG[i-1].dma_end and SG[i].dma_addr are mr-\u003epage_size aligned.\\n\\nThis leads to incorrect iova-to-va conversion in scenarios:\\n\\n1) page_size \u003c PAGE_SIZE (e.g., MR: 4K, system: 64K):\\n   ibmr-\u003eiova = 0x181800\\n   sg[0]: dma_addr=0x181800, len=0x800\\n   sg[1]: dma_addr=0x173000, len=0x1000\\n\\n   Access iova = 0x181800 + 0x810 = 0x182010\\n   Expected VA: 0x173010 (second SG, offset 0x10)\\n   Before fix:\\n     - index = (0x182010 \u003e\u003e 12) - (0x181800 \u003e\u003e 12) = 1\\n     - page_offset = 0x182010 \u0026 0xFFF = 0x10\\n     - xarray[1] stores system page base 0x170000\\n     - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)\\n\\n2) page_size \u003e PAGE_SIZE (e.g., MR: 64K, system: 4K):\\n   ibmr-\u003eiova = 0x18f800\\n   sg[0]: dma_addr=0x18f800, len=0x800\\n   sg[1]: dma_addr=0x170000, len=0x1000\\n\\n   Access iova = 0x18f800 + 0x810 = 0x190010\\n   Expected VA: 0x170010 (second SG, offset 0x10)\\n   Before fix:\\n     - index = (0x190010 \u003e\u003e 16) - (0x18f800 \u003e\u003e 16) = 1\\n     - page_offset = 0x190010 \u0026 0xFFFF = 0x10\\n     - xarray[1] stores system page for dma_addr 0x170000\\n     - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)\\n\\nYi Zhang reported a kernel panic[1] years ago related to this defect.\\n\\nSolution:\\n1. Replace xarray with pre-allocated rxe_mr_page array for sequential\\n   indexing (all MR page indices are contiguous)\\n2. Each rxe_mr_page stores both struct page* and offset within the\\n   system page\\n3. Handle MR page_size != PAGE_SIZE relationships:\\n   - page_size \u003e PAGE_SIZE: Split MR pages into multiple system pages\\n   - page_size \u003c= PAGE_SIZE: Store offset within system page\\n4. Add boundary checks and compatibility validation\\n\\nThis ensures correct iova-to-va conversion regardless of MR page size\\nand system PAGE_SIZE relationship, while improving performance through\\narray-based sequential access.\\n\\nTests on 4K and 64K PAGE_SIZE hosts:\\n- rdma-core/pytests\\n  $ ./build/bin/run_tests.py  --dev eth0_rxe\\n- blktest:\\n  $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd\\n\\n[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/sw/rxe/rxe_mr.c\",\"drivers/infiniband/sw/rxe/rxe_verbs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"592627ccbdff0ec6fff00fc761142a76db750dd4\",\"lessThan\":\"409c2c5508f3d30627bea576f8676de523cb906e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"592627ccbdff0ec6fff00fc761142a76db750dd4\",\"lessThan\":\"836f6c13c9674027793f720be3f15ecd2b90b6ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"592627ccbdff0ec6fff00fc761142a76db750dd4\",\"lessThan\":\"12985e5915a0b8354796efadaaeb201eed115377\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e443760b8b7b1e6723f4408afa056b2bc4fea12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.2.3\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/sw/rxe/rxe_mr.c\",\"drivers/infiniband/sw/rxe/rxe_verbs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12985e5915a0b8354796efadaaeb201eed115377\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/409c2c5508f3d30627bea576f8676de523cb906e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/836f6c13c9674027793f720be3f15ecd2b90b6ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.