SECURELYN
Free ScanFree consultation

CVE-2026-98365

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic: if (iova mr-ibmr.iova || iova + length mr-ibmr.iova + mr-ibmr.length) A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferenc…

Scores

9.8
CVSS 9.8 out of 10, critical severity.
0.4%
EPSS 0.4% chance of exploitation in the next 30 days.

The facts

Published
6 October 2026
Last changed
7 October 2026
NVD status
Received
Severity
Critical, CVSS 9.8 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known exploited
Not in the CISA Known Exploited Vulnerabilities catalogue in this build.
EPSS
0.4% chance of exploitation activity in the next 30 days (percentile 31).

Is there a Securelyn advisory?

Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.

References