Linux kernel Soft-RoCE drivers/infiniband/sw/rxe/rxe_mr.c (mem_check_range): The bounds check that is supposed to

Impact

The bounds check that is supposed to confine an incoming RDMA READ/WRITE to the registered memory region overflows, so a request with a large offset passes validation and the software RoCE stack services it against memory outside the region. The result is out-of-bounds kernel read (leaking another tenant's buffers back over the wire) or write (corruption, escalation). This is the Soft-RoCE analogue of CVE-2014-8159 and matters disproportionately in AI clusters because rxe is what gets loaded when operators want RoCE semantics on nodes whose NICs lack hardware offload - test rigs, mixed-generation racks, and CPU-only staging nodes sitting on the same fabric as the GPU nodes.

Who can reach it

Local user with an rxe verbs device, and - because rxe services requests arriving over UDP from the network - a remote peer that already holds a valid QP/rkey pair for the target. On a flat fabric with no RDMA-level authentication, reaching that state is a low bar.

What to do

Kernel upgrade to 4.9.10+ or a backport of commit 647bf3d8a8e5777319da92af672289b2a6c4dc66 (IB/rxe: fix mem_check_range integer overflow). Rolling reboot. Cheap interim control that most operators overlook: rxe is not needed on nodes with real RDMA hardware - blacklist the rdma_rxe module fleet-wide and the surface disappears without touching the kernel.

References