CVE-2026-46133: Linux Kernel RDMA/rxe DoS Vulnerability

CVE-2026-46133 Overview

CVE-2026-46133 is a Linux kernel vulnerability in the Soft RoCE (RDMA over Converged Ethernet) driver, RDMA/rxe. The flaw allows a single unauthenticated UDP packet to trigger a kernel panic on systems with the rxe module loaded and an rxe link configured. The issue stems from improper validation of unknown Infiniband Base Transport Header (BTH) opcodes prior to Invariant CRC (ICRC) processing. The defect predates the related commit 7244491dab34 and reaches back to the initial Soft RoCE driver implementation.

Critical Impact
A remote attacker can crash an affected Linux host by sending a single 48-byte UDP packet to port 4791, with no authentication, no Queue Pair, and no established RDMA connection required.

Affected Products

Linux kernel builds with CONFIG_RDMA_RXE=y (Soft RoCE driver)
Linux kernel versions reproducing on v7.0-rc7 with prior fix 7244491dab34 applied
Distributions shipping the in-tree rxe driver prior to commits referenced in the patch set

Discovery Timeline

2026-05-28 - CVE-2026-46133 published to the National Vulnerability Database (NVD)
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46133

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the rxe_icrc_hdr() function used by the Soft RoCE driver to validate the Invariant CRC of incoming RDMA packets. The rxe_opcode[] lookup table is sized at 256 entries but is populated only for defined Infiniband opcodes. Any undefined opcode, such as 0xff, maps to a zero-initialized entry where length == 0.

The prior validation check, pkt->paylen < header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE, degenerates to pkt->paylen < 0 + bth_pad(pkt) + RXE_ICRC_SIZE when length is zero. This fails to bound paylen adequately. Subsequently, rxe_icrc_hdr() computes rxe_opcode[pkt->opcode].length - RXE_BTH_BYTES, which underflows and passes a large value to rxe_crc32(). The CRC routine then reads past the end of the socket buffer payload.

Root Cause

The root cause is missing validation of the BTH opcode field before length arithmetic executes against the sparsely populated rxe_opcode[] table. Zero-initialized entries are treated as valid metadata, producing arithmetic underflow when the entry length is subtracted from RXE_BTH_BYTES. KASAN confirms the resulting slab out-of-bounds read in crc32_le+0x115/0x170.

Attack Vector

Exploitation requires no authentication, no RDMA Queue Pair, and no established connection. An attacker sends a 48-byte UDP packet to destination port 4791 with BTH opcode=0xff and QPN=IB_MULTICAST_QPN. The packet reaches rxe_udp_encap_recv() and traverses rxe_rcv() into rxe_icrc_check(), where the underflow occurs. Repeated packets fault on unmapped memory and panic the kernel, producing a remote denial of service condition.

The vulnerability is reachable on any host where an administrator has executed rdma link add rxe0 type rxe netdev eth0 or equivalent, exposing UDP/4791 on the configured interface. No further configuration is required.

Detection Methods for CVE-2026-46133

Indicators of Compromise

Kernel panic messages referencing crc32_le, rxe_icrc_hdr, rxe_icrc_check, and rxe_rcv in the call trace
KASAN reports indicating slab-out-of-bounds reads originating from rxe_udp_encap_recv
Unexpected inbound UDP traffic to port 4791 from untrusted networks
Hosts running the rxe module that experience repeated unexplained reboots

Detection Strategies

Inspect loaded kernel modules for rdma_rxe on production hosts and inventory exposure
Query rdma link show output across the fleet to identify configured Soft RoCE interfaces
Correlate kernel oops or panic events with inbound UDP/4791 traffic in network telemetry
Compare running kernel build identifiers against vendor advisories listing the fix commits 006a3a5f7534, 4c6f86d85d03, 6fa18025e578, e3dc3a2fb05f, and f8ee926431a7

Monitoring Recommendations

Monitor for unsolicited UDP/4791 (RoCEv2) flows ingressing untrusted network segments
Forward kernel ring buffer messages (dmesg, journalctl -k) to a central log store for panic detection
Alert on systems that boot with newer-than-expected uptime resets accompanied by RDMA stack traces

How to Mitigate CVE-2026-46133

Immediate Actions Required

Unload the rdma_rxe kernel module on hosts that do not require Soft RoCE: modprobe -r rdma_rxe
Block inbound UDP/4791 at perimeter firewalls and host-based filters for systems where RoCEv2 is not in use
Apply the upstream Linux kernel patches referenced in the Linux Kernel Commit 006a3a5f7534 series
Reboot patched hosts to ensure the updated kernel is active

Patch Information

The fix rejects packets whose opcode has no rxe_opcode[] entry, detected via the zero mask or zero length, before any length arithmetic runs. Patches are available across stable trees in the following commits: 006a3a5f7534, 4c6f86d85d03, 6fa18025e578, e3dc3a2fb05f, and f8ee926431a7.

Workarounds

Prevent automatic loading of the driver via /etc/modprobe.d/: add blacklist rdma_rxe and install rdma_rxe /bin/true
Restrict UDP/4791 ingress to known RoCE peers using iptables or nftables rules
Remove any rxe links with rdma link delete rxe0 where Soft RoCE is not operationally required

bash

# Configuration example
# Disable the rxe module and block RoCEv2 UDP port at the host
sudo rdma link delete rxe0 2>/dev/null
sudo modprobe -r rdma_rxe
echo 'blacklist rdma_rxe' | sudo tee /etc/modprobe.d/blacklist-rdma_rxe.conf
sudo iptables -A INPUT -p udp --dport 4791 -j DROP