Use-After-Free Vulnerability in Linux Kernel's RDMA/rxe Product

CVE-2026-64582

What is CVE-2026-64582?

A vulnerability exists in the Linux kernel's RDMA/rxe component, specifically within the rxe_mmap function, where a use-after-free condition occurs. When the rxe_mmap_info struct is removed from the pending_mmaps list, the pending_lock is released while its reference count remains at one. This creates a scenario where a concurrent DESTROY_CQ ioctl can be called, potentially leading to a kernel crash or a page-level use-after-free. Attackers could exploit this flaw to cause system instability or possibly gain unauthorized access to sensitive data by referencing stale pointers. The risk is primarily due to the timing of operations, though achieving this exploit is statistically challenging due to the narrow window of opportunity.

References