CVE-2026-90423
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, rxe_odp_mr_init_user() releases umem_odp and returns an error. rxe_reg_user_mr() then unwinds the error through rxe_cleanup(), rxe_mr_cleanup(), ib_umem_release(mr->umem). There is an IS_ERR_OR_NULL(umem) check at the start of ib_umem_release(). But since mr->umem is NOT reset to NULL in the error handling path of rxe_odp_mr_init_user(), the check passes and it reads already-freed fields like umem->is_dmabuf, causing UAF. Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again.
How to fix
- Linux Linux5f1933163327c9f1c8f2a341c6cb551aaf231ff9, 4cfb448705da3171d44d9cbe7be53ff03284d532, 51f2c8d2c99fc1f452f7113c08a35edcc4bf8732 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 ≤ v < 5f1933163327c9f1c8f2a341c6cb551aaf231ff9, d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 ≤ v < 4cfb448705da3171d44d9cbe7be53ff03284d532, d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 ≤ v < 51f2c8d2c99fc1f452f7113c08a35edcc4bf8732, 6.15 | 5f1933163327c9f1c8f2a341c6cb551aaf231ff9, 4cfb448705da3171d44d9cbe7be53ff03284d532, 51f2c8d2c99fc1f452f7113c08a35edcc4bf8732 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.