CVE-2026-64582

A flaw was found in the Linux kernel's RDMA/rxe component. A race condition in the rxe_mmap() function, which manages memory for Remote Direct Memory Access (RDMA) operations, can lead to a use-after-free vulnerability. A local attacker could exploit this timing issue to cause a system crash, resulting in a denial of service. In some scenarios, this could also potentially lead to a page-level use-after-free, which might allow for further system compromise.

This vulnerability is rated as an Important impact because an authenticated local user with access to InfiniBand/RDMA device interfaces can exploit this race condition to induce kernel memory corruption, potentially leading to local privilege escalation or a kernel crash. In standard Red Hat Enterprise Linux deployments, the rdma_rxe kernel module is not loaded by default unless software RoCE functionality is explicitly configured. Systems that do not use Soft-RoCE or that restrict access to RDMA user space nodes are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the rxe kernel module from loading. This can be achieved by blacklisting the module.

Create a file named /etc/modprobe.d/blacklist-rxe.conf with the following content:

blacklist rxe

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This mitigation may impact functionality that relies on the RDMA/rxe module.