---
id: CVE-2026-46043
title: 'RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

  rxe_rcv() currently checks only that the incoming packet is at least
  header_size(pkt) bytes long befor…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 <
    c4376c672c3648d5bdc31dfffc329d07164f93c4
  - >-
    Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 <
    5fedefec757192dcaad29a664ac332c7601be144
  - >-
    Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 <
    2c0d71ef12f46c57d37bc571f3f2797db7eb50cc
  - >-
    Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 <
    2fd4f8b749309a61c3f3f88ee8891d94f79e1240
  - >-
    Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 <
    f83519a4c122c9c7a850a2197648a9ff4c67c520
  - >-
    Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 <
    9b924f3a26b21330a837cfe72e819b6393bbeeaa
  - >-
    Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 <
    e8ee0e792d475b1067c199ef0af1b6221fa6f43d
  - >-
    Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 <
    7244491dab347f648e661da96dc0febadd9daec3
  - Linux 4.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:19:11.752774Z'
published: '2026-05-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:49.243Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46043'
references:
  - url: 'https://git.kernel.org/stable/c/c4376c672c3648d5bdc31dfffc329d07164f93c4'
  - url: 'https://git.kernel.org/stable/c/5fedefec757192dcaad29a664ac332c7601be144'
  - url: 'https://git.kernel.org/stable/c/2c0d71ef12f46c57d37bc571f3f2797db7eb50cc'
  - url: 'https://git.kernel.org/stable/c/2fd4f8b749309a61c3f3f88ee8891d94f79e1240'
  - url: 'https://git.kernel.org/stable/c/f83519a4c122c9c7a850a2197648a9ff4c67c520'
  - url: 'https://git.kernel.org/stable/c/9b924f3a26b21330a837cfe72e819b6393bbeeaa'
  - url: 'https://git.kernel.org/stable/c/e8ee0e792d475b1067c199ef0af1b6221fa6f43d'
  - url: 'https://git.kernel.org/stable/c/7244491dab347f648e661da96dc0febadd9daec3'
tags:
  - cve.org
epss: 0.00514
epssPercentile: 0.4249
ingestedAt: '2026-10-16T17:24:46.704Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

rxe_rcv() currently checks only that the incoming packet is at least
header_size(pkt) bytes long before payload_size() is used.

However, payload_size() subtracts both the attacker-controlled BTH pad
field and RXE_ICRC_SIZE from pkt->paylen:

  payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt)
                 - RXE_ICRC_SIZE

This means a short packet can still make payload_size() underflow even
if it includes enough bytes for the fixed headers. Simply requiring
header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a
packet with a forged non-zero BTH pad can still leave payload_size()
negative and pass an underflowed value to later receive-path users.

Fix this by validating pkt->paylen against the full minimum length
required by payload_size(): header_size(pkt) + bth_pad(pkt) +
RXE_ICRC_SIZE.

## Affected

- `Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < c4376c672c3648d5bdc31dfffc329d07164f93c4`
- `Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 5fedefec757192dcaad29a664ac332c7601be144`
- `Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 2c0d71ef12f46c57d37bc571f3f2797db7eb50cc`
- `Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 2fd4f8b749309a61c3f3f88ee8891d94f79e1240`
- `Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < f83519a4c122c9c7a850a2197648a9ff4c67c520`
- `Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 9b924f3a26b21330a837cfe72e819b6393bbeeaa`
- `Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < e8ee0e792d475b1067c199ef0af1b6221fa6f43d`
- `Linux >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 7244491dab347f648e661da96dc0febadd9daec3`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.