CVE-2026-46114: Linux Kernel Information Disclosure Flaw

CVE-2026-46114 Overview

CVE-2026-46114 is a Linux kernel information disclosure vulnerability in the Soft RoCE (rxe) RDMA driver. The atomic_write_reply() function in drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt) without validating that the packet actually carries an 8-byte payload. A remote initiator can send an ATOMIC_WRITE request with the RETH length set to zero, causing the responder to read past the logical end of the packet into skb->head tailroom. The responder then writes those bytes into the attacker's memory region (MR) via rxe_mr_do_atomic_write(), leaking kernel memory across the network.

Critical Impact
Remote attackers with RDMA connectivity can disclose adjacent kernel skb tailroom contents, including kernel strings and partial direct-map pointer words, four bytes per probe.

Affected Products

Linux kernel with the Soft RoCE (rxe) driver enabled
drivers/infiniband/sw/rxe/rxe_resp.c in mainline kernels prior to the fix
Distributions shipping vulnerable CONFIG_RDMA_RXE builds

Discovery Timeline

2026-05-28 - CVE-2026-46114 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46114

Vulnerability Analysis

The Soft RoCE driver implements InfiniBand semantics in software over standard Ethernet. The ATOMIC_WRITE opcode, defined by IBA specification oA19-28, requires a payload of exactly 8 bytes. The responder path in atomic_write_reply() reads the payload with a direct cast: value = *(u64 *)payload_addr(pkt);.

The upstream check_rkey() function validates request length by comparing pktlen against resid, but it accepts the degenerate case where both equal zero. A zero-length ATOMIC_WRITE therefore passes validation and reaches the unchecked 64-bit dereference. The driver reads eight bytes from beyond the logical packet boundary into the surrounding socket buffer head tailroom.

Those eight bytes are then committed to the attacker-controlled memory region. Four bytes belong to the packet's own trailing ICRC and are predictable, but the remaining four bytes are adjacent kernel heap content. Repeated probing yields a continuous stream of kernel memory contents, including recognizable kernel strings and fragments of direct-map pointers usable for KASLR defeat.

Root Cause

The root cause is missing strict length validation for a protocol-fixed opcode. check_rkey() performs only a relational length check, not an equality check against the IBA-mandated 8-byte size for ATOMIC_WRITE. The responder code path assumes the payload exists without confirming it.

Attack Vector

A remote attacker with RDMA reachability to a host running rxe registers a memory region and issues an ATOMIC_WRITE work request with the RETH DMA Length set to 0. The malformed PDU traverses check_rkey(), reaches atomic_write_reply(), and triggers the out-of-bounds read. The attacker then reads back their own MR to recover leaked kernel memory.

No authentication beyond standard RDMA queue-pair establishment is required. The exploit is repeatable, silent, and leaves no crash trace. See the upstream fix commit for the corrected length enforcement.

Detection Methods for CVE-2026-46114

Indicators of Compromise

Inbound RoCE/RDMA traffic containing ATOMIC_WRITE opcodes with RETH DMA Length field equal to zero.
Sustained high-rate, low-payload RDMA requests originating from a single remote queue pair against an rxe-enabled host.
Unexpected loading or enablement of the rdma_rxe kernel module on hosts that do not require Soft RoCE.

Detection Strategies

Inspect RoCEv2 UDP port 4791 traffic for ATOMIC_WRITE PDUs with non-conformant length fields using packet capture or eBPF probes on the RDMA stack.
Audit kernel logs and dmesg for rxe responder anomalies and unusual RDMA queue-pair creation patterns from untrusted networks.
Correlate kernel module load events for rdma_rxe with subsequent inbound RDMA flows from external sources.

Monitoring Recommendations

Maintain visibility on InfiniBand and RoCE traffic at network boundaries, treating RDMA as a sensitive east-west protocol.
Track kernel version inventory and confirm patch status across hosts where CONFIG_RDMA_RXE is enabled.
Alert on first-seen RDMA connections to production hosts from outside trusted compute fabrics.

How to Mitigate CVE-2026-46114

Immediate Actions Required

Apply the upstream Linux kernel patch that hoists a strict 8-byte equality check for ATOMIC_WRITE into check_rkey().
Unload the rdma_rxe module on hosts that do not actively use Soft RoCE: modprobe -r rdma_rxe.
Restrict RDMA traffic to trusted compute fabrics and block RoCEv2 (UDP/4791) at perimeter and segmentation boundaries.

Patch Information

The fix adds a strict length validation in check_rkey() so the responder rejects any ATOMIC_WRITE PDU whose payload is not exactly 8 bytes, preventing the out-of-bounds dereference in atomic_write_reply(). Patched commits are available in stable trees:

Workarounds

Blacklist the rdma_rxe module where Soft RoCE is not required by adding blacklist rdma_rxe to /etc/modprobe.d/.
Filter RoCEv2 UDP/4791 ingress from untrusted networks using host firewalls or fabric ACLs.
Restrict RDMA device access to authorized service accounts and remove unused RDMA user-space libraries from exposed hosts.