The Linux kernel RDMA/rxe subsystem had a vulnerability where, for non-SRQ Queue Pairs (QPs), the responder read WQE fields directly from a shared queue buffer mapped into userspace. This allowed a malicious user to alter fields such as num_sge or sge entries while the kernel was processing the WQE, resulting in out-of-bounds reads in functions rxe_resp_check_length() and copy_data(). The fix introduces a function get_recv_wqe() that validates num_sge and copies the WQE into a kernel-local buffer before processing, aligning with the approach used for SRQ WQEs, thus preventing user-space tampering during kernel processing.

The vulnerability could lead to out-of-bounds reads in kernel memory during RDMA operations, potentially causing kernel crashes or information disclosure. However, no known exploits are reported in the wild. The impact is limited to systems using the affected RDMA/rxe non-SRQ receive path.

A fix has been implemented that copies the WQE to a kernel-local buffer with validation before processing, preventing user-space manipulation. Users should apply the official Linux kernel update that includes this patch once available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.