CVE-2026-80864

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix responder UAF on IB QP MAX DEST RD ATOMIC modify qp

rxe qp from attr() handles IB QP MAX DEST RD ATOMIC outside the IB QP STATE path, so it holds no state lock and runs while the responder task rxe receiver() (recv task on rxe wq) is live. A modify qp() setting only that attribute calls free rd atomic resources() then alloc rd atomic resources(), swapping qp->resp.resources[] while rxe prepare res()/find resource() walk it; free rd atomic resources() also leaves the cached pointer qp->resp.res dangling. A local unprivileged user can race the free/realloc into a use-after-free in rxe receiver() (local DoS).

Drain recv task around the swap with rxe disable task()/rxe enable task(), as rxe qp reset() already does when tearing this array down, re-enabling only after alloc rd atomic resources() succeeds so the responder never resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear qp->resp.res in free rd atomic resources(), like the rxe resp.c completion paths.

Reproduced under KASAN; the slab-use-after-free in rxe receiver() is gone.