CVE-2026-98365

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) software driver. An unauthenticated remote attacker can cause a Denial of Service (DoS) or out-of-bounds memory access by sending specially crafted network requests that trigger an integer overflow during memory range validation. This flaw allows invalid requests to bypass boundary checks, resulting in a system crash.

An integer overflow in the RXE RDMA memory region range check can allow a crafted RETH IOVA and length to bypass MR bounds validation. A remote RoCE peer may cause rxe_mr_iova_to_index and rxe_mr_copy_xarray to use a very large index, resulting in out of bounds kernel memory access and potentially a kernel crash or memory corruption. For the CVSS the PR:N applies because the attack is performed by a remote RDMA peer and does not require local code execution on the target. AV:A is used because RXE RoCE is normally reachable only from an RDMA fabric or local network segment, not directly from the public Internet. The base impact includes limited confidentiality and integrity risk with high availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.