CVE-2026-46043: Linux Kernel RDMA Buffer Overflow Flaw

CVE-2026-46043 Overview

CVE-2026-46043 is a Linux kernel vulnerability in the Soft RoCE (RDMA over Converged Ethernet) driver, RDMA/rxe. The flaw exists in the rxe_rcv() receive path, which validates only that an incoming packet meets header_size(pkt) before invoking payload_size(). Because payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen, a crafted short packet can cause an integer underflow. The underflowed value then propagates to later receive-path consumers, creating potential for memory corruption or denial of service in kernel context.

Critical Impact
A forged BTH pad value in a short RDMA packet can drive payload_size() negative, passing an underflowed length into the kernel receive path.

Affected Products

Linux kernel — drivers/infiniband/sw/rxe Soft RoCE driver
Distributions shipping vulnerable stable kernels prior to the referenced fix commits
Systems with the rdma_rxe module loaded and exposed to untrusted network traffic

Discovery Timeline

2026-05-27 - CVE-2026-46043 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46043

Vulnerability Analysis

The rxe_rcv() function in the Soft RoCE driver performs an initial length check that only ensures the inbound packet is at least header_size(pkt) bytes long. After this check, the driver calls payload_size() to compute the user payload length. That computation subtracts the BTH (Base Transport Header) pad field and the ICRC trailer from pkt->paylen.

Because both subtracted values are not accounted for in the initial bounds check, a short packet containing the minimum fixed headers can still produce a negative result. The result is stored in an unsigned width and underflows to a large positive value, which downstream receive-path code then treats as a valid payload length. This is an integer underflow caused by improper input validation in a kernel network path [CWE-191].

Root Cause

The root cause is an insufficient pre-condition check in rxe_rcv(). The required minimum is header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE, but the implementation only validated header_size(pkt). Even tightening the check to include RXE_ICRC_SIZE is insufficient because bth_pad(pkt) is read from the attacker-controlled BTH header, allowing a non-zero pad to still underflow the subtraction.

Attack Vector

An attacker with the ability to send raw RDMA packets to a host running the rdma_rxe driver can craft a packet that is large enough to satisfy header_size(pkt) but encodes a non-zero BTH pad value. When rxe_rcv() forwards the packet to payload_size(), the resulting negative arithmetic underflows to a very large unsigned length. Downstream functions consuming that length can perform oversized reads or out-of-bounds memory accesses inside the kernel.

The Soft RoCE driver is reachable from any interface configured with rxe, so exploitation does not require authentication. No proof-of-concept exploit is publicly documented at the time of disclosure.

The vulnerability is described in the upstream patch series. See the kernel commit fixing rxe_rcv validation for the exact change.

Detection Methods for CVE-2026-46043

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN reports referencing rxe_rcv, payload_size, or other symbols under drivers/infiniband/sw/rxe/.
Sudden RDMA traffic spikes from untrusted sources targeting hosts with the rdma_rxe module loaded.
Malformed RoCE packets with abnormally small paylen values combined with non-zero BTH pad fields.

Detection Strategies

Inspect inbound RoCE traffic with packet capture tooling and flag frames where the computed payload length would be negative under the documented formula.
Audit hosts for loaded rdma_rxe modules using lsmod | grep rdma_rxe and correlate with kernel versions that lack the fix commits.
Monitor kernel logs for repeated soft lockups or memory access faults originating in the RDMA receive path.

Monitoring Recommendations

Enable kernel address sanitizer (KASAN) in non-production environments to surface out-of-bounds reads triggered by malformed RDMA packets.
Forward dmesg and journalctl -k output to a central log platform and alert on stack traces containing rxe_ symbols.
Track kernel package versions across the fleet and alert when nodes running rdma_rxe fall behind the patched stable release.

How to Mitigate CVE-2026-46043

Immediate Actions Required

Update to a Linux stable kernel that includes the fix commits referenced in the NVD entry, such as f83519a4c122 and the related backports.
If patching is not immediately possible, unload the rdma_rxe module on hosts that do not require Soft RoCE: modprobe -r rdma_rxe.
Restrict RDMA traffic at the network layer so that only trusted peers can reach RDMA-capable interfaces.

Patch Information

The fix validates pkt->paylen against the full minimum length required by payload_size(), namely header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE, before the subtraction is performed. Patched commits are available in the upstream stable trees:

Workarounds

Blacklist the rdma_rxe kernel module on systems that do not use Soft RoCE by adding blacklist rdma_rxe under /etc/modprobe.d/.
Apply host firewall rules to drop unsolicited UDP traffic on RoCEv2 port 4791 from untrusted networks.
Segment RDMA fabrics onto dedicated VLANs or physical networks isolated from general-purpose traffic.

bash

# Configuration example
# Prevent the vulnerable module from loading until the kernel is patched
echo "blacklist rdma_rxe" | sudo tee /etc/modprobe.d/disable-rxe.conf
sudo modprobe -r rdma_rxe

# Block RoCEv2 traffic from untrusted sources (example: nftables)
sudo nft add rule inet filter input udp dport 4791 ip saddr != 10.0.0.0/8 drop