CVE-2026-64582 Overview
CVE-2026-64582 is a use-after-free vulnerability in the Linux kernel's RDMA/rxe (Soft RoCE) driver, specifically within the rxe_mmap() function. The flaw stems from a race condition in which rxe_mmap() removes a rxe_mmap_info structure from the pending_mmaps list and releases pending_lock while the structure's reference count remains at 1. A concurrent DESTROY_CQ ioctl on another CPU can drop the final reference and free both the vmalloc-backed object and the rxe_mmap_info allocation while remap_vmalloc_range() is still walking page table entries.
Critical Impact
A local unprivileged attacker can trigger a kernel general protection fault or achieve a page-level use-after-free, potentially leading to memory corruption and privilege escalation.
Affected Products
- Linux kernel with RDMA/rxe (Soft RoCE) driver enabled
- Distributions shipping vulnerable versions of the drivers/infiniband/sw/rxe subsystem
- Systems exposing /dev/infiniband/uverbs* to unprivileged users
Discovery Timeline
- 2026-08-05 - CVE CVE-2026-64582 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-64582
Vulnerability Analysis
The vulnerability resides in the Soft RoCE (rxe) driver, which provides a software implementation of RDMA over Converged Ethernet. When user space maps a queue via ib_uverbs_mmap, the kernel invokes rxe_mmap() to install the mapping. The function removes the corresponding rxe_mmap_info entry from the pending list, drops the spinlock, and then calls remap_vmalloc_range() to populate the user virtual memory area. Only after the remap completes does rxe_vma_open() execute kref_get() to raise the reference count from 1 to 2.
Between the lock release and the kref_get(), another thread can issue a DESTROY_CQ ioctl. That path calls kref_put(), which drops the count from 1 to 0, invokes rxe_mmap_release, calls vfree(ip->obj) to clear the vmalloc PTEs mid-walk, and frees the rxe_mmap_info allocation with kfree(ip).
Root Cause
The root cause is missing reference count acquisition before releasing the serializing spinlock [CWE-416]. The kref should be incremented while pending_lock is held so that the object cannot be freed while remap_vmalloc_range_partial() walks the vmalloc PTEs. The existing ordering allows the object's lifetime to end during the page-table walk.
Attack Vector
The attack requires local access with permission to open an RDMA uverbs device. An attacker races an mmap() on an rxe queue against a DESTROY_CQ ioctl targeting the same queue. Two outcomes are possible. First, vmalloc_to_page() returns NULL when vfree wins the per-PTE race, and vm_insert_page(NULL) triggers a general protection fault in validate_page_before_insert. Second, vmalloc_to_page() reads a stale PTE before vfree clears it, installing a user PTE pointing to a freed page. If that page is later reallocated by vmalloc, the attacker obtains a page-level use-after-free primitive. The race window between the last insert_page and the kref_get is very short, making the second outcome statistically difficult but not impossible.
Detection Methods for CVE-2026-64582
Indicators of Compromise
- Kernel oops or general protection fault referencing validate_page_before_insert, insert_page, vm_insert_page, or remap_vmalloc_range_partial in the call trace
- KASAN reports flagging use-after-free within rxe_mmap or rxe_mmap_release
- Unexpected crashes on hosts that expose /dev/infiniband/uverbs* to non-root users
Detection Strategies
- Enable KASAN in test kernels to surface the race deterministically during fuzzing
- Audit workloads that combine mmap calls on uverbs file descriptors with concurrent DESTROY_CQ ioctls from unprivileged processes
- Correlate kernel crash telemetry with loaded modules to identify hosts running rdma_rxe
Monitoring Recommendations
- Forward /var/log/kern.log and dmesg output to a central log store and alert on GPF signatures within RDMA symbols
- Track modprobe, rdma link add, and load events for the rdma_rxe module on production hosts
- Monitor process activity for unprivileged users opening /dev/infiniband/uverbs* devices
How to Mitigate CVE-2026-64582
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by the Linux kernel maintainers as soon as vendor builds are available
- Unload the rdma_rxe module on systems that do not require Soft RoCE using modprobe -r rdma_rxe
- Restrict access to /dev/infiniband/uverbs* so that only trusted service accounts can open RDMA user verbs devices
Patch Information
The fix is distributed across multiple stable branches. Refer to the upstream commits: Linux Kernel Commit 3525987a, Linux Kernel Commit 35744ab3, Linux Kernel Commit 665fb7d2, Linux Kernel Commit e038d42c, and Linux Kernel Commit e59a6aa8. The corrected ordering acquires the kref while holding pending_lock so the rxe_mmap_info structure cannot be freed during the PTE walk.
Workarounds
- Blacklist the rdma_rxe kernel module on hosts that do not use Soft RoCE
- Enforce mandatory access controls (SELinux, AppArmor) to prevent unprivileged processes from opening uverbs devices
- Use namespace isolation or seccomp filters to block the mmap and ioctl syscall combinations against uverbs file descriptors in untrusted containers
# Disable the rdma_rxe module if Soft RoCE is not required
sudo rmmod rdma_rxe 2>/dev/null
echo 'blacklist rdma_rxe' | sudo tee /etc/modprobe.d/blacklist-rdma-rxe.conf
sudo update-initramfs -u
# Restrict access to uverbs devices
sudo chmod 0600 /dev/infiniband/uverbs*
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
