CVE-2026-46114
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In the Linux kernel's RDMA/rxe driver, a vulnerability was found due to missing validation of ATOMIC_WRITE payload length. A remote attacker can send a zero-length request, causing 8 bytes beyond the packet end to be read and written to the victim's memory, leading to kernel data leak.
Risk Assessment
An attacker can remotely leak 4 bytes of skb tailroom (including sensitive kernel data like string fragments or pointers) per probe, which may aid in further privilege escalation.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit adding strict length check in check_rkey()). If update is not possible, temporarily disable the rxe module or restrict trusted RDMA traffic sources.
Related vulnerabilities
- CVE-2026-71377Critical
Command argument injection vulnerability in Cosminexus Component Container. Allows an attacker to execute unauthorized system commands.
- CVE-2026-71376Critical
OS command injection vulnerability in Cosminexus Component Container. Allows an attacker to execute arbitrary commands on the server.
- CVE-2026-62645Critical
Vulnerability in Reyrolle 7SR5 exposes information through the web interface that can be used to calculate current and past session ID numbers. An attacker could bypass authentication and gain unauthorized access to the device.
- CVE-2026-50093Critical
Vulnerability in the OIS web module of Siveillance Control allows an attacker to upload arbitrary files to the server. Successful exploitation could allow an attacker to gain root access on the host system, potentially leading to full compromise of the OIS environment.
- CVE-2026-71374Critical
Deserialization of untrusted data vulnerability in Cosminexus Component Container. Could allow an attacker to execute arbitrary code or cause a crash.
- CVE-2026-86510Critical
The D-Link DIR-822A router version A_101 has a vulnerability in the tunnel_set_params function of the L2TP Control Message Parser component, leading to an out-of-bounds write. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-86509Critical
The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.
- CVE-2026-76969Critical
The @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application, and partial impact on confidentiality of business data.
- CVE-2026-66768Critical
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on confidentiality, integrity, and availability.
- CVE-2026-58240Critical
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access could register an unauthorized component and potentially perform unauthorized actions, resulting in high impact on confidentiality, integrity, and availability.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)payload_addr(pkt); check_rkey() previously accepted an ATOMIC_WRITE request with pktlen == resid == 0 because the length validation only compared pktlen against resid. A remote initiator that sets the RETH length to 0 therefore reaches atomic_write_reply() with a zero-byte logical payload, and the responder reads sizeof(u64) bytes from past the logical end of the packet into skb->head tailroom, then writes those 8 bytes into the attacker's MR via rxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel tailroom per probe (the other 4 bytes are the packet's own trailing ICRC). IBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is protocol-invalid. Hoist a strict length check into check_rkey() so the responder never reaches the unchecked dereference, and keep the existing WRITE-family length logic for the normal RDMA WRITE path. Reproduced on mainline with an unmodified rxe driver: a sustained zero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer bytes into the attacker's MR, including recognisable kernel strings and partial kernel-direct-map pointer words. With this patch applied the responder rejects the PDU and the MR stays all-zero.