Critical 9.1Published May 27, 2026

CVE-2026-46043RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

Updated under an hour ago (Oct 27, 2026, 7:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE.

CVSS: 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-190
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8700e3e7c4857d28ebaa824509934556da0b3e76 before c4376c672c3648d5bdc31dfffc329d07164f93c4; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 5fedefec757192dcaad29a664ac332c7601be144; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 2c0d71ef12f46c57d37bc571f3f2797db7eb50cc; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 2fd4f8b749309a61c3f3f88ee8891d94f79e1240; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before f83519a4c122c9c7a850a2197648a9ff4c67c520; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 9b924f3a26b21330a837cfe72e819b6393bbeeaa; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before e8ee0e792d475b1067c199ef0af1b6221fa6f43d; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before 7244491dab347f648e661da96dc0febadd9daec3	CNA record
linux linux_kernel linux:linux_kernel	from 4.8 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/c4376c672c3648d5bdc31dfffc329d07164f93c4	patch
https://git.kernel.org/stable/c/5fedefec757192dcaad29a664ac332c7601be144	patch
https://git.kernel.org/stable/c/2c0d71ef12f46c57d37bc571f3f2797db7eb50cc	patch
https://git.kernel.org/stable/c/2fd4f8b749309a61c3f3f88ee8891d94f79e1240	patch
https://git.kernel.org/stable/c/f83519a4c122c9c7a850a2197648a9ff4c67c520	patch
https://git.kernel.org/stable/c/9b924f3a26b21330a837cfe72e819b6393bbeeaa	patch
https://git.kernel.org/stable/c/e8ee0e792d475b1067c199ef0af1b6221fa6f43d	patch
https://git.kernel.org/stable/c/7244491dab347f648e661da96dc0febadd9daec3	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.