CVE-2026-93107

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93107", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.085Z", "datePublished": "2026-09-17T16:11:17.791Z", "dateUpdated": "2026-10-19T09:05:39.979Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:05:39.979Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state\n\nWhen do_complete() finds the QP in the error state it returns\nRESPST_CHK_RESOURCE. Before commit 49dc9c1f0c7e (\"RDMA/rxe: Cleanup\nreset state handling in rxe_resp.c\") this was the flush loop:\ncheck_resource() had an error-state branch that fetched each remaining\nrecv WQE and completed it with IB_WC_WR_FLUSH_ERR, without touching\nthe current packet. That commit removed the error-state branch from\ncheck_resource() (draining is now done at rxe_receiver() entry) but\nkept the do_complete() error-state return.\n\nAs a result, when a QP moves to the error state while a packet is\nbeing completed - e.g. an rdma_cm disconnect racing with receive\nprocessing - the responder state machine loops back into the request\nprocessing chain with the already-completed packet still in hand:\ncheck_resource() fetches a fresh recv WQE, execute()/send_data_in()\ncopies the same packet payload again, do_complete() posts another\nIB_WC_SUCCESS CQE (qp->resp.status is still 0), and control returns\nto the error-state check. The loop re-executes the same packet once\nper posted recv WQE (observed: ~1000 duplicate IB_WC_SUCCESS\ncompletions of one SEND, one per ~8us, matching the RQ occupancy)\nuntil the RQ is exhausted, after which qp->resp.wqe is NULL and\nsend_data_in() dereferences it:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000014\n Workqueue: rxe_wq do_work\n RIP: copy_data+0x29/0x1f0\n Call Trace:\n send_data_in+0x25/0x50\n rxe_receiver+0xf36/0x1dd0\n\nThe duplicate completions are indistinguishable from real receives to\nthe ULP. During an rds stress test, the message was accepted as new and\ndelivered the same datagram to user space hundreds of times, corrupting\nthe stream; any ULP that relies on RC exactly-once delivery is affected.\n\nA live packet reaching the error-state check in do_complete() has\nbeen executed and completed exactly once and must be consumed, not\nre-processed. Return RESPST_CLEANUP for it (dequeue and free); keep\nreturning RESPST_CHK_RESOURCE for the pkt == NULL case."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The reprocessed bytes are a RoCEv2 RC SEND (IB_OPCODE_RC_SEND_ONLY/LAST) received on UDP 4791 in rxe_udp_encap_recv()\u2192rxe_rcv()\u2192rxe_resp_queue_pkt(); the same peer puts the QP in ERR during do_complete() via a CM DREQ (rdma_disconnect\u2192cma_modify_qp_err) or an AETH NAK in rxe_completer().\nAC:L - The race is do_complete() in rxe_receiver() (rxe_wq recv_task) versus a concurrent rxe_qp_error()/rxe_qp_from_attr() setting IB_QPS_ERR; the attacker sends both the SEND and the DREQ/NAK, so they control both sides and can retry until the window is hit.\nPR:N - hdr_check() only binds the SEND to an established RC QP (BTH QPN, check_addr() on the QP AV, default PKey); that is the RoCE connection handshake, not a local uid or capability, so the remote peer needs no OS privileges.\nUI:N - Once the SEND is queued, rxe_receiver() runs from rxe_wq by itself; no local user action is required to process the packet or to handle the peer's DREQ/NAK.\nS:U - Duplicate IB_WC_SUCCESS completions and the copy_data() oops occur inside the host rxe responder; they do not cross a VM, IOMMU, or sandbox boundary.\nC:N - The crash is a NULL load of qp->resp.wqe->dma.resid in copy_data() (address 0x14) after the RQ is empty; earlier send_data_in() copies only replay the attacker's own SEND payload into posted recv MRs and do not disclose kernel memory.\nI:L - When do_complete() returns RESPST_CHK_RESOURCE, execute()/send_data_in() copies that same SEND into every remaining recv WQE and do_complete() posts another IB_WC_SUCCESS (qp->resp.status still 0), breaking RC exactly-once delivery for this QP's posted RQ; that is not an arbitrary kernel write.\nA:H - After the RQ is exhausted, send_data_in() calls copy_data() with qp->resp.wqe == NULL and oopses on rxe_wq (RIP copy_data), as in the reported NULL-pointer dereference."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "versions": [{"version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "lessThan": "c319b986a88cedf600c4497cd7814a891b2f9e7c", "status": "affected", "versionType": "git"}, {"version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "lessThan": "62a4b48767e06fdd64548450fae2b1ffc6ff5d69", "status": "affected", "versionType": "git"}, {"version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "lessThan": "399713f1f0eac641351c8ceaec0ab8244ddcf78c", "status": "affected", "versionType": "git"}, {"version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "lessThan": "0d37e2503efd1069a74be740eadf63ea17c96810", "status": "affected", "versionType": "git"}, {"version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "lessThan": "15ae32c4a3551c4c9da457370bdfdd65d171e512", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c319b986a88cedf600c4497cd7814a891b2f9e7c"}, {"url": "https://git.kernel.org/stable/c/62a4b48767e06fdd64548450fae2b1ffc6ff5d69"}, {"url": "https://git.kernel.org/stable/c/399713f1f0eac641351c8ceaec0ab8244ddcf78c"}, {"url": "https://git.kernel.org/stable/c/0d37e2503efd1069a74be740eadf63ea17c96810"}, {"url": "https://git.kernel.org/stable/c/15ae32c4a3551c4c9da457370bdfdd65d171e512"}], "title": "RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c319b986a88cedf600c4497cd7814a891b2f9e7c", "status": "affected", "version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "versionType": "git"}, {"lessThan": "62a4b48767e06fdd64548450fae2b1ffc6ff5d69", "status": "affected", "version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "versionType": "git"}, {"lessThan": "399713f1f0eac641351c8ceaec0ab8244ddcf78c", "status": "affected", "version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "versionType": "git"}, {"lessThan": "0d37e2503efd1069a74be740eadf63ea17c96810", "status": "affected", "version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "versionType": "git"}, {"lessThan": "15ae32c4a3551c4c9da457370bdfdd65d171e512", "status": "affected", "version": "49dc9c1f0c7e396654a31a480328fffd902fa494", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state\n\nWhen do_complete() finds the QP in the error state it returns\nRESPST_CHK_RESOURCE. Before commit 49dc9c1f0c7e (\"RDMA/rxe: Cleanup\nreset state handling in rxe_resp.c\") this was the flush loop:\ncheck_resource() had an error-state branch that fetched each remaining\nrecv WQE and completed it with IB_WC_WR_FLUSH_ERR, without touching\nthe current packet. That commit removed the error-state branch from\ncheck_resource() (draining is now done at rxe_receiver() entry) but\nkept the do_complete() error-state return.\n\nAs a result, when a QP moves to the error state while a packet is\nbeing completed - e.g. an rdma_cm disconnect racing with receive\nprocessing - the responder state machine loops back into the request\nprocessing chain with the already-completed packet still in hand:\ncheck_resource() fetches a fresh recv WQE, execute()/send_data_in()\ncopies the same packet payload again, do_complete() posts another\nIB_WC_SUCCESS CQE (qp->resp.status is still 0), and control returns\nto the error-state check. The loop re-executes the same packet once\nper posted recv WQE (observed: ~1000 duplicate IB_WC_SUCCESS\ncompletions of one SEND, one per ~8us, matching the RQ occupancy)\nuntil the RQ is exhausted, after which qp->resp.wqe is NULL and\nsend_data_in() dereferences it:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000014\n Workqueue: rxe_wq do_work\n RIP: copy_data+0x29/0x1f0\n Call Trace:\n send_data_in+0x25/0x50\n rxe_receiver+0xf36/0x1dd0\n\nThe duplicate completions are indistinguishable from real receives to\nthe ULP. During an rds stress test, the message was accepted as new and\ndelivered the same datagram to user space hundreds of times, corrupting\nthe stream; any ULP that relies on RC exactly-once delivery is affected.\n\nA live packet reaching the error-state check in do_complete() has\nbeen executed and completed exactly once and must be consumed, not\nre-processed. Return RESPST_CLEANUP for it (dequeue and free); keep\nreturning RESPST_CHK_RESOURCE for the pkt == NULL case."}], "id": "CVE-2026-93107", "lastModified": "2026-10-19T10:17:00.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-17T17:18:05.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0d37e2503efd1069a74be740eadf63ea17c96810"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15ae32c4a3551c4c9da457370bdfdd65d171e512"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/399713f1f0eac641351c8ceaec0ab8244ddcf78c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/62a4b48767e06fdd64548450fae2b1ffc6ff5d69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c319b986a88cedf600c4497cd7814a891b2f9e7c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49dc9c1f0c7e396654a31a480328fffd902fa494,c319b986a88cedf600c4497cd7814a891b2f9e7c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49dc9c1f0c7e396654a31a480328fffd902fa494,62a4b48767e06fdd64548450fae2b1ffc6ff5d69)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49dc9c1f0c7e396654a31a480328fffd902fa494,399713f1f0eac641351c8ceaec0ab8244ddcf78c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49dc9c1f0c7e396654a31a480328fffd902fa494,0d37e2503efd1069a74be740eadf63ea17c96810)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49dc9c1f0c7e396654a31a480328fffd902fa494,15ae32c4a3551c4c9da457370bdfdd65d171e512)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.52,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-19T07:30:17.072207+00:00", "updated": "2026-09-20T08:45:17.314274+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}