CVE-2026-46043

CRITICAL EPSS 39.9%
Published May 27, 20261mo ago · Modified Jun 17, 20261w ago
9.1 CVSS 3.1
Critical
Find Similar
Published May 27, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE.

CVSS Details

Base Score
9.1
Exploitability
3.9
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
39.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 7

VendorProductVersionRange
linuxlinux_kernel*≥4.8  –  <5.10.258
linuxlinux_kernel*≥5.11  –  <5.15.209
linuxlinux_kernel*≥5.16  –  <6.1.175
linuxlinux_kernel*≥6.2  –  <6.6.140
linuxlinux_kernel*≥6.7  –  <6.12.86
linuxlinux_kernel*≥6.13  –  <6.18.27
linuxlinux_kernel*≥6.19  –  <7.0.4

References 8

  • git.kernel.org https://git.kernel.org/stable/c/2c0d71ef12f46c57d37bc571f3f2797db7eb50cc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2fd4f8b749309a61c3f3f88ee8891d94f79e1240
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5fedefec757192dcaad29a664ac332c7601be144
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7244491dab347f648e661da96dc0febadd9daec3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9b924f3a26b21330a837cfe72e819b6393bbeeaa
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c4376c672c3648d5bdc31dfffc329d07164f93c4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e8ee0e792d475b1067c199ef0af1b6221fa6f43d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f83519a4c122c9c7a850a2197648a9ff4c67c520
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/2c0d71ef12f46c57d37bc571f3f2797db7eb50cc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2fd4f8b749309a61c3f3f88ee8891d94f79e1240
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5fedefec757192dcaad29a664ac332c7601be144
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7244491dab347f648e661da96dc0febadd9daec3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9b924f3a26b21330a837cfe72e819b6393bbeeaa
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c4376c672c3648d5bdc31dfffc329d07164f93c4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e8ee0e792d475b1067c199ef0af1b6221fa6f43d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f83519a4c122c9c7a850a2197648a9ff4c67c520
    Patch