CVE-2026-46114

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46114", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.098Z", "datePublished": "2026-05-28T09:35:24.638Z", "dateUpdated": "2026-10-19T19:26:44.201Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:46.194Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads\n\natomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c\nunconditionally dereferences 8 bytes at payload_addr(pkt):\n\n value = *(u64 *)payload_addr(pkt);\n\ncheck_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==\nresid == 0 because the length validation only compared pktlen against\nresid. A remote initiator that sets the RETH length to 0 therefore reaches\natomic_write_reply() with a zero-byte logical payload, and the responder\nreads sizeof(u64) bytes from past the logical end of the packet into\nskb->head tailroom, then writes those 8 bytes into the attacker's MR via\nrxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel\ntailroom per probe (the other 4 bytes are the packet's own trailing ICRC).\n\nIBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is\nprotocol-invalid. Hoist a strict length check into check_rkey() so the\nresponder never reaches the unchecked dereference, and keep the existing\nWRITE-family length logic for the normal RDMA WRITE path.\n\nReproduced on mainline with an unmodified rxe driver: a sustained\nzero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer\nbytes into the attacker's MR, including recognisable kernel strings and\npartial kernel-direct-map pointer words. With this patch applied the\nresponder rejects the PDU and the MR stays all-zero."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The rxe (Soft RoCE) responder processes RoCE v2 packets received over UDP/IP (port 4791) via rxe_udp_encap_recv(); a remote initiator crafts the malformed zero-length ATOMIC_WRITE PDU, so the vulnerable code is reachable across an L3-routable network.\nAC:L - A single protocol-valid-but-zero-length ATOMIC_WRITE packet deterministically reaches the unchecked 8-byte dereference; there is no race and no memory layout the attacker must win, making triggering fully reliable.\nPR:N - The attacker is a remote RDMA peer with no operating-system credentials on the target; completing the normal RC connection and using an advertised rkey is analogous to a network handshake, not OS privileges, so the worst-case network-facing RDMA service requires no privileges.\nUI:N - The responder processes the incoming packet automatically as part of normal QP servicing; no action by any local user or victim is required.\nS:U - The disclosed kernel memory is written into a memory region within the same kernel/RDMA security authority; no privilege or trust boundary (VM, IOMMU, sandbox) is crossed.\nC:H - Each probe leaks 4 bytes of adjacent kernel slab (skb head tailroom) into the attacker's MR, and the probe is repeatable indefinitely, streaming out kernel strings and partial direct-map pointer words \u2014 a serious, KASLR-defeating kernel memory disclosure, not a single strictly bounded read.\nI:N - The 8-byte write targets the attacker's own MR within a range validated by mr_check_range(); no kernel structure or out-of-bounds region is modified, so there is no integrity impact on the target.\nA:N - The 8-byte over-read stays within the allocated skb head buffer (tailroom) and the write stays within the validated MR, so the operation completes cleanly with no oops, panic, or hang \u2014 the author reproduced it as a clean leak, not a crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "versions": [{"version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "539cabb7b2d8ba70f55bba91db55faef11c2a6d7", "status": "affected", "versionType": "git"}, {"version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "d415fce3fcde6d7aeea6c25362a395b905811452", "status": "affected", "versionType": "git"}, {"version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "105bf79a23b85cf3a761d18a4f3e10ce88526bc1", "status": "affected", "versionType": "git"}, {"version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "7ec1ed4747f5f99f8b797bb438c5efd36079fad5", "status": "affected", "versionType": "git"}, {"version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "1114c87aa6f195cf07da55a27b2122ae26557b26", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/539cabb7b2d8ba70f55bba91db55faef11c2a6d7"}, {"url": "https://git.kernel.org/stable/c/d415fce3fcde6d7aeea6c25362a395b905811452"}, {"url": "https://git.kernel.org/stable/c/105bf79a23b85cf3a761d18a4f3e10ce88526bc1"}, {"url": "https://git.kernel.org/stable/c/7ec1ed4747f5f99f8b797bb438c5efd36079fad5"}, {"url": "https://git.kernel.org/stable/c/1114c87aa6f195cf07da55a27b2122ae26557b26"}], "title": "RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46114", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:19:49.222043Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:26:44.201Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46114", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:19:49.222043Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:19:49.779Z"}}], "cna": {"title": "RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "scenarios": [{"lang": "en", "value": "AV:N - The rxe (Soft RoCE) responder processes RoCE v2 packets received over UDP/IP (port 4791) via rxe_udp_encap_recv(); a remote initiator crafts the malformed zero-length ATOMIC_WRITE PDU, so the vulnerable code is reachable across an L3-routable network.\nAC:L - A single protocol-valid-but-zero-length ATOMIC_WRITE packet deterministically reaches the unchecked 8-byte dereference; there is no race and no memory layout the attacker must win, making triggering fully reliable.\nPR:N - The attacker is a remote RDMA peer with no operating-system credentials on the target; completing the normal RC connection and using an advertised rkey is analogous to a network handshake, not OS privileges, so the worst-case network-facing RDMA service requires no privileges.\nUI:N - The responder processes the incoming packet automatically as part of normal QP servicing; no action by any local user or victim is required.\nS:U - The disclosed kernel memory is written into a memory region within the same kernel/RDMA security authority; no privilege or trust boundary (VM, IOMMU, sandbox) is crossed.\nC:H - Each probe leaks 4 bytes of adjacent kernel slab (skb head tailroom) into the attacker's MR, and the probe is repeatable indefinitely, streaming out kernel strings and partial direct-map pointer words \u2014 a serious, KASLR-defeating kernel memory disclosure, not a single strictly bounded read.\nI:N - The 8-byte write targets the attacker's own MR within a range validated by mr_check_range(); no kernel structure or out-of-bounds region is modified, so there is no integrity impact on the target.\nA:N - The 8-byte over-read stays within the allocated skb head buffer (tailroom) and the write stays within the validated MR, so the operation completes cleanly with no oops, panic, or hang \u2014 the author reproduced it as a clean leak, not a crash."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "539cabb7b2d8ba70f55bba91db55faef11c2a6d7", "versionType": "git"}, {"status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "d415fce3fcde6d7aeea6c25362a395b905811452", "versionType": "git"}, {"status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "105bf79a23b85cf3a761d18a4f3e10ce88526bc1", "versionType": "git"}, {"status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "7ec1ed4747f5f99f8b797bb438c5efd36079fad5", "versionType": "git"}, {"status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "lessThan": "1114c87aa6f195cf07da55a27b2122ae26557b26", "versionType": "git"}], "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.140", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.88", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.30", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.7", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/539cabb7b2d8ba70f55bba91db55faef11c2a6d7"}, {"url": "https://git.kernel.org/stable/c/d415fce3fcde6d7aeea6c25362a395b905811452"}, {"url": "https://git.kernel.org/stable/c/105bf79a23b85cf3a761d18a4f3e10ce88526bc1"}, {"url": "https://git.kernel.org/stable/c/7ec1ed4747f5f99f8b797bb438c5efd36079fad5"}, {"url": "https://git.kernel.org/stable/c/1114c87aa6f195cf07da55a27b2122ae26557b26"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads\n\natomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c\nunconditionally dereferences 8 bytes at payload_addr(pkt):\n\n value = *(u64 *)payload_addr(pkt);\n\ncheck_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==\nresid == 0 because the length validation only compared pktlen against\nresid. A remote initiator that sets the RETH length to 0 therefore reaches\natomic_write_reply() with a zero-byte logical payload, and the responder\nreads sizeof(u64) bytes from past the logical end of the packet into\nskb->head tailroom, then writes those 8 bytes into the attacker's MR via\nrxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel\ntailroom per probe (the other 4 bytes are the packet's own trailing ICRC).\n\nIBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is\nprotocol-invalid. Hoist a strict length check into check_rkey() so the\nresponder never reaches the unchecked dereference, and keep the existing\nWRITE-family length logic for the normal RDMA WRITE path.\n\nReproduced on mainline with an unmodified rxe driver: a sustained\nzero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer\nbytes into the attacker's MR, including recognisable kernel strings and\npartial kernel-direct-map pointer words. With this patch applied the\nresponder rejects the PDU and the MR stays all-zero."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:46.194Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46114", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:26:44.201Z", "dateReserved": "2026-05-13T15:03:33.098Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-28T09:35:24.638Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "539cabb7b2d8ba70f55bba91db55faef11c2a6d7", "status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "versionType": "git"}, {"lessThan": "d415fce3fcde6d7aeea6c25362a395b905811452", "status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "versionType": "git"}, {"lessThan": "105bf79a23b85cf3a761d18a4f3e10ce88526bc1", "status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "versionType": "git"}, {"lessThan": "7ec1ed4747f5f99f8b797bb438c5efd36079fad5", "status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "versionType": "git"}, {"lessThan": "1114c87aa6f195cf07da55a27b2122ae26557b26", "status": "affected", "version": "034e285f8b99062a0cf29112e1232154a6a44aa5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.88", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4", "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads\n\natomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c\nunconditionally dereferences 8 bytes at payload_addr(pkt):\n\n value = *(u64 *)payload_addr(pkt);\n\ncheck_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==\nresid == 0 because the length validation only compared pktlen against\nresid. A remote initiator that sets the RETH length to 0 therefore reaches\natomic_write_reply() with a zero-byte logical payload, and the responder\nreads sizeof(u64) bytes from past the logical end of the packet into\nskb->head tailroom, then writes those 8 bytes into the attacker's MR via\nrxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel\ntailroom per probe (the other 4 bytes are the packet's own trailing ICRC).\n\nIBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is\nprotocol-invalid. Hoist a strict length check into check_rkey() so the\nresponder never reaches the unchecked dereference, and keep the existing\nWRITE-family length logic for the normal RDMA WRITE path.\n\nReproduced on mainline with an unmodified rxe driver: a sustained\nzero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer\nbytes into the attacker's MR, including recognisable kernel strings and\npartial kernel-direct-map pointer words. With this patch applied the\nresponder rejects the PDU and the MR stays all-zero."}], "id": "CVE-2026-46114", "lastModified": "2026-10-19T20:18:31.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46114", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:19:49.222043Z", "version": "2.0.3"}}]}, "published": "2026-05-28T10:16:26.870", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/105bf79a23b85cf3a761d18a4f3e10ce88526bc1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1114c87aa6f195cf07da55a27b2122ae26557b26"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/539cabb7b2d8ba70f55bba91db55faef11c2a6d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7ec1ed4747f5f99f8b797bb438c5efd36079fad5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d415fce3fcde6d7aeea6c25362a395b905811452"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads", "id": "2482618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482618"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically within the rxe driver. A remote attacker could exploit this vulnerability by sending a specially crafted ATOMIC_WRITE request with a zero-byte payload. This improper handling of non-8-byte ATOMIC_WRITE payloads allows the attacker to read past the intended packet boundary. Consequently, sensitive kernel memory, such as kernel strings and partial kernel-direct-map pointer words, can be disclosed into the attacker's memory region."], "name": "CVE-2026-46114", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46114\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46114\nhttps://lore.kernel.org/linux-cve-announce/2026052813-CVE-2026-46114-2563@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[034e285f8b99062a0cf29112e1232154a6a44aa5,539cabb7b2d8ba70f55bba91db55faef11c2a6d7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[034e285f8b99062a0cf29112e1232154a6a44aa5,d415fce3fcde6d7aeea6c25362a395b905811452)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[034e285f8b99062a0cf29112e1232154a6a44aa5,105bf79a23b85cf3a761d18a4f3e10ce88526bc1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[034e285f8b99062a0cf29112e1232154a6a44aa5,7ec1ed4747f5f99f8b797bb438c5efd36079fad5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[034e285f8b99062a0cf29112e1232154a6a44aa5,1114c87aa6f195cf07da55a27b2122ae26557b26)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T11:30:15.486821+00:00", "updated": "2026-10-23T01:30:13.894824+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}