CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's software RDMA (RDMA/rxe) driver, specifically in how it handles ATOMIC_WRITE operation payloads. A remote, unauthenticated attacker can send a crafted ATOMIC_WRITE packet with a zero-byte payload over the network; the responder then reads 8 bytes past the logical end of the packet from kernel skb head-buffer tailroom and writes those bytes into the attacker's registered memory region, disclosing up to 4 bytes of kernel memory per probe. Successful exploitation leaks kernel heap and stack content including partial pointer values and recognizable kernel strings. A patched-image rebuild at fix version 6.6.140 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the exposed RDMA/rxe responder service over the network; no local access is required.

• AuthenticationNot required

  No credentials or account are needed; the malformed ATOMIC_WRITE packet can be sent by any unauthenticated remote initiator.

• Victim interactionNot required

  The responder processes the malformed packet automatically with no user action required on the target host.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply sets the RETH length field to zero in the ATOMIC_WRITE request and the unchecked dereference fires deterministically.

Blast Radius

• The attacker reads up to 4 bytes of kernel skb head-buffer tailroom per probe, with the other 4 bytes coming from the packet's own trailing ICRC.
• Leaked bytes can include recognizable kernel strings and partial kernel-direct-map pointer words, aiding further exploitation such as KASLR bypass.
• The leaked data is written directly into the attacker's registered memory region (MR), making exfiltration trivial and requiring no separate read step.
• Integrity and availability of the target system are not directly affected by this exploit path; impact is limited to confidential kernel memory disclosure.