CVE-2026-93107

A flaw was found in the Linux kernel's RDMA/rxe component. When a Queue Pair (QP) transitions to an error state during packet completion, the system may reprocess an already-completed packet. This can lead to duplicate data being delivered to user applications, causing data stream corruption. Furthermore, this issue can result in a kernel NULL pointer dereference, leading to a system crash and a Denial of Service (DoS).

RDMA RXE responder processing can reprocess an already completed packet when a QP enters the error state during receive completion. A remote RDMA peer may trigger this through a disconnect race while packets are being completed, causing the same payload to be copied into multiple receive WQEs and reported as multiple successful completions. This can corrupt upper layer protocol streams that rely on exactly once RC delivery, and after the receive queue is exhausted the path can hit a NULL pointer dereference and crash the kernel. For the CVSS the PR:N is used because the attacker does not need a local account on the victim if the RDMA RXE endpoint is reachable as a peer. The issue is network reachable within RDMA or storage fabrics, but these fabrics are typically isolated data center networks and are usually not exposed to the public Internet. Impact is integrity loss through duplicate delivery and denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.