CVE-2026-90423RDMA/rxe: Fix UAF in ODP init error-handling path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, rxe_odp_mr_init_user() releases umem_odp and returns an error. rxe_reg_user_mr() then unwinds the error through rxe_cleanup(), rxe_mr_cleanup(), ib_umem_release(mr->umem). There is an IS_ERR_OR_NULL(umem) check at the start of ib_umem_release(). But since mr->umem is NOT reset to NULL in the error handling path of rxe_odp_mr_init_user(), the check passes and it reads already-freed fields like umem->is_dmabuf, causing UAF. Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 before 5f1933163327c9f1c8f2a341c6cb551aaf231ff9; from d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 before 4cfb448705da3171d44d9cbe7be53ff03284d532; from d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 before 51f2c8d2c99fc1f452f7113c08a35edcc4bf8732 | CNA record |
References
- https://git.kernel.org/stable/c/5f1933163327c9f1c8f2a341c6cb551aaf231ff9
- https://git.kernel.org/stable/c/4cfb448705da3171d44d9cbe7be53ff03284d532
- https://git.kernel.org/stable/c/51f2c8d2c99fc1f452f7113c08a35edcc4bf8732
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.