CVE-2026-92525

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the rxe component. A local, unprivileged user can exploit this vulnerability by submitting malformed work queue entries (WQE). This can lead to an out-of-bounds read operation, resulting in a system crash and a denial of service (DoS).

A vmalloc out-of-bounds read in the RDMA rxe requester path can occur because a user QP WQE is read from an mmap ring controlled by userspace and num_sge or cur_sge were not validated before indexing wqe dma sge in copy_data(). A local user with access to the rxe RDMA device can post a malformed WQE with an out-of-range cur_sge or oversized num_sge and trigger an invalid kernel read. For the CVSS the PR:L is used because triggering requires a local user or process with access to the RDMA userspace interface, but not full administrative privileges. The issue is not directly network reachable because the malformed state is supplied through the local user QP ring rather than by remote packets. Impact is at least local denial of service via kernel crash or KASAN-detected fault, with limited confidentiality impact considered in the paranoid score due to the concrete invalid read primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.