CVE-2026-46133

A flaw was found in the Linux kernel's Soft RoCE (RDMA/rxe) driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service (DoS) on the affected system. The issue arises from insufficient validation of unknown opcodes before performing length arithmetic during Cyclic Redundancy Check (CRC) processing.

Soft RoCE RXE can process an unauthenticated UDP packet with an unknown BTH opcode before rejecting the opcode. Because the rxe_opcode array entry for an unknown opcode is zero initialized, length arithmetic in ICRC processing can underflow and pass a huge size to rxe_crc32(), causing an out-of-bounds read of skb payload memory. For the CVSS the PR:N is used because a remote sender only needs network reachability to the RXE UDP port when an RXE device is configured. The issue is network reachable, but practical exposure requires Soft RoCE to be enabled and an rxe link to exist. Impact is primarily denial of service via kernel panic. The paranoid score includes low confidentiality impact because the primitive is a real OOB read, but no user visible disclosure or write primitive is shown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.