CVE-2026-64582: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64582 is a use-after-free vulnerability in the Linux kernel's RDMA/rxe subsystem, specifically in the rxe_mmap() function. It affects Linux kernel versions from 4.8 up to (but not including) the patched stable releases: 5.10.265, 5.15.216, 6.1.183, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2. The vulnerability was published on August 5, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-825: Expired Pointer Dereference) in rxe_mmap(), which removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref count is still 1. The function then calls remap_vmalloc_range() to walk page table entries (PTEs) without holding any lock. Concurrently, a DESTROY_CQ ioctl on another CPU can decrement the kref to 0, call vfree(ip->obj) to clear vmalloc PTEs mid-walk, and then kfree(ip) to free the rxe_mmap_info struct. This yields two outcomes: (1) a kernel crash when vmalloc_to_page() returns NULL and vm_insert_page(NULL) triggers a general protection fault in validate_page_before_insert, or (2) a page-level UAF where a user VMA retains a PTE to a freed page that may later be reallocated by vmalloc (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in a kernel crash (denial of service) or, in a harder-to-achieve scenario, a page-level use-after-free enabling local privilege escalation with high confidentiality, integrity, and availability impact. A local attacker who gains kernel code execution could compromise the entire host, access sensitive kernel memory, and potentially pivot to other workloads on the same system. The page-level UAF primitive is noted to be statistically difficult to achieve due to the very short exploitation time window (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time, though the bug report references a poc process in the kernel crash trace, suggesting a PoC was used internally during discovery. The EPSS score is approximately 0.117% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and permissions to perform RDMA operations, including the ability to issue DESTROY_CQ ioctls (GitHub Advisory, Red Hat Bugzilla).

1. Gain local access: Obtain a local user account on a system with RDMA/rxe (Soft-RoCE) enabled and accessible RDMA device permissions (e.g., membership in the rdma group or equivalent).
2. Create a Completion Queue (CQ): Use the InfiniBand uverbs interface (/dev/infiniband/uverbsX) to create a completion queue, which allocates a rxe_mmap_info struct and adds it to the pending_mmaps list.
3. Trigger concurrent mmap: In one thread, call mmap() on the uverbs file descriptor with the appropriate offset to invoke rxe_mmap(), which removes the rxe_mmap_info from pending_mmaps, releases pending_lock, and begins walking PTEs via remap_vmalloc_range().
4. Race with DESTROY_CQ: Simultaneously, in a second thread, issue a DESTROY_CQ ioctl to decrement the kref to 0, triggering vfree(ip->obj) (clearing vmalloc PTEs mid-walk) and kfree(ip) (freeing the struct).
5. Achieve crash or UAF: If the race is won by the DESTROY_CQ path, the kernel crashes with a GPF in validate_page_before_insert. In the harder-to-win scenario, the user VMA retains a stale PTE to a freed page, enabling a page-level UAF for potential privilege escalation if the freed page is reallocated and controlled by the attacker (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel oops messages containing general protection fault and references to validate_page_before_insert, vm_insert_page, remap_vmalloc_range_partial, or rxe_mmap in /var/log/kern.log or dmesg output.
• Logs: KASAN reports indicating null-ptr-deref in the range [0x0000000000000008-0x000000000000000f] associated with the RDMA/rxe subsystem.
• Process: Unexpected processes (e.g., named poc or similar) with low UIDs (non-root) accessing /dev/infiniband/uverbsX devices and issuing rapid sequences of CQ creation and destruction ioctls.
• Kernel: System panics or unexpected reboots on hosts with RDMA/rxe (Soft-RoCE) enabled, particularly on multi-CPU systems under concurrent RDMA workloads (GitHub Advisory, Red Hat Bugzilla).

Apply the upstream kernel patches fixing the race condition in rxe_mmap() and the DESTROY_CQ ioctl path. Patched stable kernel versions are: 5.10.265, 5.15.216, 6.1.183, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2. The fix commits are available in the stable kernel tree (e.g., 3525987a, 35744ab3, 665fb7d2, e038d42c, e59a6aa8). As a workaround where immediate patching is not feasible, restrict access to RDMA operations and /dev/infiniband/ devices to only trusted users (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked the vulnerability via Bugzilla (Bug 2511448) and assigned it high severity, with the upstream kernel advisory referenced from the linux-cve-announce mailing list. Security community coverage includes posts on SecurityOnline.info discussing the RDMA/rxe kernel LPE and a PoC reference, as well as Mastodon/infosec.exchange commentary. The Yocto Project security mailing list also flagged the CVE for embedded Linux maintainers (Red Hat Bugzilla).