CVE-2026-80863: Linux Kernel RDMA Buffer Overflow Vulnerability

CVE-2026-80863 Overview

CVE-2026-80863 is an out-of-bounds write vulnerability in the Linux kernel's Soft RDMA over Ethernet (RXE) driver, located in the free_rd_atomic_resources() function in drivers/infiniband/sw/rxe/rxe_qp.c. The flaw is triggered when a queue pair (QP) is modified through the InfiniBand uverbs interface. Updating qp->attr.max_dest_rd_atomic before freeing the old atomic resource array causes the free path to iterate past the original allocation. KASAN detects the resulting slab out-of-bounds write during rxe_qp_from_attr(). The issue affects Linux kernel builds that ship the RXE software RDMA driver and is fixed by multiple stable kernel commits.

Critical Impact
Local users with access to the RDMA uverbs interface can trigger a slab out-of-bounds write, leading to kernel memory corruption, denial of service, or potential local privilege escalation.

Affected Products

Linux kernel with the RDMA/rxe (Soft-RoCE) software driver compiled and loaded
Distributions exposing /dev/infiniband/uverbs* to unprivileged or containerized workloads
Kernel branches prior to the stable fixes referenced in the upstream patch series

Discovery Timeline

2026-09-04 - CVE-2026-80863 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80863

Vulnerability Analysis

The RXE driver maintains a per-QP array sized by qp->attr.max_dest_rd_atomic to track responder-side RDMA read and atomic resources. During rxe_qp_from_attr(), the code path that services ib_uverbs_modify_qp writes the new max_dest_rd_atomic value into qp->attr before releasing the previously allocated resource array. When the new value exceeds the old one, free_rd_atomic_resources() iterates using the updated counter and walks beyond the bounds of the original allocation. Each iteration invokes free_rd_atomic_resource(), which performs a 4-byte write past the slab object. KASAN reports this as slab-out-of-bounds at drivers/infiniband/sw/rxe/rxe_qp.c:180.

The vulnerability is classified as an Out-of-Bounds Write [CWE-787] in kernel space. Because the corruption occurs in a kmalloc slab cache, an attacker who can control neighboring allocations may be able to overwrite adjacent kernel objects.

Root Cause

The root cause is an ordering bug. The driver updates the QP attribute that determines array length before freeing the array associated with the previous length. The correct sequence is to free the old array using the old length, then update qp->attr.max_dest_rd_atomic and allocate a new array. The upstream fix reorders these operations so the free loop always references the size that matches the allocation being released.

Attack Vector

Exploitation requires local access to the RDMA verbs interface, typically /dev/infiniband/uverbs*. An unprivileged user or container workload that can open this device and issue ib_uverbs_modify_qp requests can reach rxe_qp_from_attr() and trigger the out-of-bounds write by changing max_dest_rd_atomic on an existing QP. The KASAN trace in the advisory demonstrates the syscall path from userspace write() through ib_uverbs_write() to the vulnerable free loop. No network attack vector is required; the RXE driver only needs to be loaded.

The vulnerability manifests during a normal QP state transition, so no unusual verbs are needed. See the upstream patch commits for the exact instruction sequence and fix diff.

Detection Methods for CVE-2026-80863

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in free_rd_atomic_resource or free_rd_atomic_resources in kernel logs
Kernel oops or panic traces referencing rxe_qp_from_attr+ and rxe_modify_qp+ frames
Unexpected loading of the rdma_rxe kernel module on systems that do not use software RDMA

Detection Strategies

Audit which processes and containers hold file descriptors on /dev/infiniband/uverbs* devices
Monitor dmesg and journalctl -k for KASAN or general protection fault traces originating in drivers/infiniband/sw/rxe/
Correlate calls to ib_uverbs_modify_qp with process identity using audit or eBPF-based syscall telemetry

Monitoring Recommendations

Enable kernel auditing for openat on InfiniBand device nodes and forward events to a centralized log store
Alert on unprivileged processes issuing repeated modify_qp operations that alter max_dest_rd_atomic
Track kernel module load events for rdma_rxe to detect unexpected activation of the vulnerable driver

How to Mitigate CVE-2026-80863

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 142c8165, 30b90b55, 4e5f753e, 9b7d66ea, bc6e9437, bdf5decc, d219e7a8, de329533, and f5e6580a
Unload the rdma_rxe module on hosts that do not require software RDMA using modprobe -r rdma_rxe
Restrict access to /dev/infiniband/uverbs* to trusted system accounts only

Patch Information

The fix is distributed across multiple stable branches. Refer to the upstream commits: Kernel Patch Commit 142c8165, Kernel Patch Commit 30b90b55, Kernel Patch Commit 4e5f753e, Kernel Patch Commit 9b7d66ea, Kernel Patch Commit bc6e9437, Kernel Patch Commit bdf5decc, Kernel Patch Commit d219e7a8, Kernel Patch Commit de329533, and Kernel Patch Commit f5e6580a. Rebuild and reboot into the patched kernel after installation.

Workarounds

Blacklist the rdma_rxe module in /etc/modprobe.d/ on systems that do not require Soft-RoCE functionality
Use SELinux, AppArmor, or seccomp policies to deny container workloads access to InfiniBand uverbs devices
Remove or tighten permissions on /dev/infiniband/uverbs* so only privileged RDMA services can open the interface

bash

# Configuration example: disable the vulnerable rxe driver until patched
echo 'blacklist rdma_rxe' | sudo tee /etc/modprobe.d/disable-rdma-rxe.conf
sudo modprobe -r rdma_rxe 2>/dev/null || true
sudo update-initramfs -u