CVE-2026-46325
A critical vulnerability in the Linux kernel's RDMA/rxe subsystem incorrectly converts IOVA to virtual addresses when memory regions use page sizes different from the system PAGE_SIZE. This can cause wrong memory accesses, leading to kernel panics or memory corruption. The flaw has been resolved in the kernel source code.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users
Real-world impact
Potential kernel panic, memory corruption, or privilege escalation on systems using RDMA over RXE.
Why this severity
CVSS 3.1 base score 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
- 01Obtain the latest Linux kernel update from your distribution that includes the patch for CVE-2026-46325.
- 02Install or upgrade the kernel package.
- 03Reboot the system to load the patched kernel.
NVD-referenced vendor advisory (Linux kernel patch)
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.