Read the docs
TI-2026-55877 Aliases CVE-2026-80864GHSA-6j94-p35f-gvmj

RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Partial Red Hat: 25 fixed, 3 without a fix

No CVSS vector from any source. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while the responder task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting only that attribute calls free_rd_atomic_resources() then alloc_rd_atomic_resources(), swapping qp->resp.resources[] while rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources() also leaves the cached pointer qp->resp.res dangling. A local unprivileged user can race the free/realloc into a use-after-free in rxe_receiver() (local DoS). Drain recv_task around the swap with rxe_disable_task()/rxe_enable_task(), as rxe_qp_reset() already does when tearing this array down, re-enabling only after alloc_rd_atomic_resources() succeeds so the responder never resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear qp->resp.res in free_rd_atomic_resources(), like the rxe_resp.c completion paths. Reproduced under KASAN; the slab-use-after-free in rxe_receiver() is gone.

Why it matters now

EPSS 0.00197 9th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.1.191, 6.6.160, 6.12.108 +4Red Hat: 13 advisoriesRed Hat: 25 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux4.8 and later6.1.191, 6.6.160, 6.12.108, 6.18.49, 7.1.13, 7.2.3, 7.3Patch availableCNA
  • Linux VendorLinux Affected 4.8 and later Fixed in 6.1.191, 6.6.160, 6.12.108, 6.18.49, 7.1.13, 7.2.3, 7.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.160, 6.12.108, 6.18.49, 7.1.13, 7.2.3, 7.3

Red Hat 13 advisories

  • RHSA-2026:95212 Released 2026-11-04 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.184.1.el8_10, kernel-4.18.0-553.184.1.el8_10, kernel-abi-stablelists-4.18.0-553.184.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.184.1.el8_10
  • RHSA-2026:95100 Released 2026-11-04 · Red Hat rating Important
    kernel-rt security, bug fix, and enhancement update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.184.1.rt7.525.el8_10, kernel-rt-core-4.18.0-553.184.1.rt7.525.el8_10, kernel-rt-debug-4.18.0-553.184.1.rt7.525.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.184.1.rt7.525.el8_10, kernel-rt-core-4.18.0-553.184.1.rt7.525.el8_10, kernel-rt-debug-4.18.0-553.184.1.rt7.525.el8_10 +7
  • RHSA-2026:89714 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.16.74 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202610242150-0, rhcos-ppc64le-416.94.202610242150-0, rhcos-s390x-416.94.202610242150-0 +1
Show 10 more Red Hat advisories
  • RHSA-2026:90272 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.12.102 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202610250235-0
  • RHSA-2026:89725 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.18.59 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202610242013-0, rhcos-ppc64le-418.94.202610242013-0, rhcos-s390x-418.94.202610242013-0 +1
  • RHSA-2026:89651 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.19.53 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202610241701-0, rhcos-ppc64le-4.19.9.6.202610241701-0, rhcos-s390x-4.19.9.6.202610241701-0 +1
  • RHSA-2026:89232 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.21.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 rhcos-aarch64-4.21.9.6.202610241345-0, rhcos-ppc64le-4.21.9.6.202610241345-0, rhcos-s390x-4.21.9.6.202610241345-0 +1
  • RHSA-2026:89333 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.20.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 rhcos-aarch64-4.20.9.6.202610242033-0, rhcos-ppc64le-4.20.9.6.202610242033-0, rhcos-s390x-4.20.9.6.202610242033-0 +1
  • RHSA-2026:77219 Released 2026-10-08 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) kernel-tools-libs-devel-5.14.0-570.147.1.el9_6, libperf-5.14.0-570.147.1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) kernel-64k-debug-devel-5.14.0-570.147.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.147.1.el9_6, kernel-64k-devel-5.14.0-570.147.1.el9_6 +12
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel-5.14.0-570.147.1.el9_6, kernel-64k-5.14.0-570.147.1.el9_6, kernel-64k-core-5.14.0-570.147.1.el9_6 +28
    • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt-5.14.0-570.147.1.el9_6, kernel-rt-64k-5.14.0-570.147.1.el9_6, kernel-rt-64k-core-5.14.0-570.147.1.el9_6 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt-5.14.0-570.147.1.el9_6, kernel-rt-core-5.14.0-570.147.1.el9_6, kernel-rt-debug-5.14.0-570.147.1.el9_6 +11
  • RHSA-2026:77301 Released 2026-10-07 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) bpftool-4.18.0-477.172.1.el8_8, kernel-4.18.0-477.172.1.el8_8, kernel-abi-stablelists-4.18.0-477.172.1.el8_8 +14
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) bpftool-4.18.0-477.172.1.el8_8, kernel-4.18.0-477.172.1.el8_8, kernel-abi-stablelists-4.18.0-477.172.1.el8_8 +14
  • RHSA-2026:77218 Released 2026-10-07 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) kernel-64k-debug-devel-5.14.0-427.154.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.154.1.el9_4, kernel-64k-devel-5.14.0-427.154.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool-7.3.0-427.154.1.el9_4, kernel-5.14.0-427.154.1.el9_4, kernel-64k-5.14.0-427.154.1.el9_4 +29
    • Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt-5.14.0-427.154.1.el9_4, kernel-rt-core-5.14.0-427.154.1.el9_4, kernel-rt-debug-5.14.0-427.154.1.el9_4 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt-5.14.0-427.154.1.el9_4, kernel-rt-core-5.14.0-427.154.1.el9_4, kernel-rt-debug-5.14.0-427.154.1.el9_4 +11
  • RHSA-2026:77217 Released 2026-10-07 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) bpftool-4.18.0-305.211.1.el8_4, kernel-4.18.0-305.211.1.el8_4, kernel-abi-stablelists-4.18.0-305.211.1.el8_4 +14
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) bpftool-4.18.0-305.211.1.el8_4, kernel-4.18.0-305.211.1.el8_4, kernel-abi-stablelists-4.18.0-305.211.1.el8_4 +19
  • RHSA-2026:77216 Released 2026-10-07 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) bpftool-4.18.0-372.220.1.el8_6, kernel-4.18.0-372.220.1.el8_6, kernel-abi-stablelists-4.18.0-372.220.1.el8_6 +14
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) bpftool-4.18.0-372.220.1.el8_6, kernel-4.18.0-372.220.1.el8_6, kernel-abi-stablelists-4.18.0-372.220.1.el8_6 +19

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:77219
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:77218
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:77219
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:95212
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:77217
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:77216
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:77301
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:77218
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:77219
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:77217
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:77216
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:77301
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:95212
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2026:95100
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2026:95100
Red Hat Enterprise Linux Real Time E4S (v.9.4)Fixed RHSA-2026:77218
Red Hat Enterprise Linux Real Time EUS (v.9.6)Fixed RHSA-2026:77219
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)Fixed RHSA-2026:77218
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)Fixed RHSA-2026:77219
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:90272
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:89714
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:89725
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:89651
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:89333
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:89232
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80864
  2. 2026-10-03 Alias added: GHSA-6j94-p35f-gvmj
  3. 2026-10-07 Fix available: RHSA-2026:77216 · Red Hat
  4. 2026-10-07 Fix available: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · Red Hat
  5. 2026-10-07 Fix available: RHSA-2026:77301 · Red Hat
  6. 2026-10-07 Fix available: RHSA-2026:77218 · Red Hat
  7. 2026-10-07 Fix available: RHSA-2026:77217 · Red Hat
  8. 2026-10-07 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS E4S (v.8.8) +5 · Red Hat
  9. 2026-10-09 Fix available: RHSA-2026:77219 · Red Hat
  10. 2026-10-09 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6) +2 · Red Hat
  11. 2026-10-19 Fix available: Linux/[email protected] · CNA
  12. 2026-10-21 Fix available: Linux/[email protected], Linux/Linux@82257379061c0a7aba6c77081d988339982af115 · CNA
  13. 2026-10-21 1 new reference · CNA
  14. 2026-10-29 Fix available: RHSA-2026:89232 · Red Hat
  15. 2026-10-29 Fix available: RHSA-2026:89651 · Red Hat
  16. 2026-10-29 Fix available: RHSA-2026:89714 · Red Hat
  17. 2026-10-29 Fix available: RHSA-2026:90272 · Red Hat
  18. 2026-10-29 Fix available: RHSA-2026:89725 · Red Hat
  19. 2026-10-29 Fix available: RHSA-2026:89333 · Red Hat
  20. 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.18 +3 · Red Hat
  21. 2026-10-30 Affected versions changed · Red Hat
  22. 2026-10-30 Fix available: Linux/[email protected], Linux/Linux@87e40635d77aa19088550698c81eb295d5131f71 · CNA
  23. 2026-10-30 1 new reference · CNA
  24. 2026-11-04 Fix available: RHSA-2026:95212 · Red Hat
  25. 2026-11-04 Fix available: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · Red Hat
  26. 2026-11-06 Fix available: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · Red Hat
  27. 2026-11-06 Fix available: RHSA-2026:95100 · Red Hat

References

Other 7

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences