VulnerabilityPublished 4 Sep 2026Updated 21 Oct 2026

CVE-2026-80864: Linux kernel · RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in ffa4f0be69656be1755090f02db38d49816585c6 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ffa4f0be69656be1755090f02db38d49816585c6, d4cd32eb8bd2b0ffbdc7b1f3d82ce6a371f8f844, 82257379061c0a7aba6c77081d988339982af115 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < ffa4f0be69656be1755090f02db38d49816585c6	Fixed in ffa4f0be69656be1755090f02db38d49816585c6
LinuxLinux	Affected ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < d4cd32eb8bd2b0ffbdc7b1f3d82ce6a371f8f844	Fixed in d4cd32eb8bd2b0ffbdc7b1f3d82ce6a371f8f844
LinuxLinux	Affected ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < 82257379061c0a7aba6c77081d988339982af115	Fixed in 82257379061c0a7aba6c77081d988339982af115
LinuxLinux	Affected ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < 0136b528b753c5a56e4d997ef20b86bb6750b8fb	Fixed in 0136b528b753c5a56e4d997ef20b86bb6750b8fb
LinuxLinux	Affected ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < 60dfd47929cd1e7070daa810d40ce538d888410d	Fixed in 60dfd47929cd1e7070daa810d40ce538d888410d
LinuxLinux	Affected ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < 6f7014237405e7f032b5c53a82d9eccf6161c291	Fixed in 6f7014237405e7f032b5c53a82d9eccf6161c291

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while the responder task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting only that attribute calls free_rd_atomic_resources() then alloc_rd_atomic_resources(), swapping qp->resp.resources[] while rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources() also leaves the cached pointer qp->resp.res dangling. A local unprivileged user can race the free/realloc into a use-after-free in rxe_receiver() (local DoS). Drain recv_task around the swap with rxe_disable_task()/rxe_enable_task(), as rxe_qp_reset() already does when tearing this array down, re-enabling only after alloc_rd_atomic_resources() succeeds so the responder never resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear qp->resp.res in free_rd_atomic_resources(), like the rxe_resp.c completion paths. Reproduced under KASAN; the slab-use-after-free in rxe_receiver() is gone.

References

Community reviews

Loading reviews…