CyberSecBulletin
CVE-2026-46133NVD status: Undergoing Analysis

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-46133 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 318787fa7193bd79691f2ebce4e80cb6abd0faef, 6a79b1ea0fcb2c998fda6a793050f66146e9cc42, 599cfdf44c1701c581cd4a21f1e1e03f8dc3840b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.57% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 318787fa7193bd79691f2ebce4e80cb6abd0faef or 6a79b1ea0fcb2c998fda6a793050f66146e9cc42 or 599cfdf44c1701c581cd4a21f1e1e03f8dc3840b or e3dc3a2fb05f4ed49c7f20594c4c52350d032189, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.140, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux8700e3e7c4857d28ebaa824509934556da0b3e76 up to, but not including, 318787fa7193bd79691f2ebce4e80cb6abd0faef; 8700e3e7c4857d28ebaa824509934556da0b3e76 up to, but not including, 6a79b1ea0fcb2c998fda6a793050f66146e9cc42; 8700e3e7c4857d28ebaa824509934556da0b3e76 up to, but not including, 599cfdf44c1701c581cd4a21f1e1e03f8dc3840b; 8700e3e7c4857d28ebaa824509934556da0b3e76 up to, but not including, e3dc3a2fb05f4ed49c7f20594c4c52350d032189; 8700e3e7c4857d28ebaa824509934556da0b3e76 up to, but not including, f8ee926431a7bbec2b10c1290664af2cb290b983; 8700e3e7c4857d28ebaa824509934556da0b3e76 up to, but not including, 006a3a5f75345c6a0dbf13fd3ee01406e93b6733; 8700e3e7c4857d28ebaa824509934556da0b3e76 up to, but not including, 6fa18025e5782afff91415fd5217b39c1e4837d7; 8700e3e7c4857d28ebaa824509934556da0b3e76 up to, but not including, 4c6f86d85d03cdb33addce86aa69aa795ca6c47a; and 1 more ranges318787fa7193bd79691f2ebce4e80cb6abd0faef, 6a79b1ea0fcb2c998fda6a793050f66146e9cc42, 599cfdf44c1701c581cd4a21f1e1e03f8dc3840b, e3dc3a2fb05f4ed49c7f20594c4c52350d032189, f8ee926431a7bbec2b10c1290664af2cb290b983, 006a3a5f75345c6a0dbf13fd3ee01406e93b6733
LinuxLinux Kernel4.8 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.140; 6.7 up to, but not including, 6.12.88; 6.13 up to, but not including, 6.18.30; 6.19 up to, but not including, 7.0.7; 7.15.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated UDP packet can still trigger panic. That patch handled payload_size() underflow only for valid opcodes with short packets, not for packets carrying an unknown opcode. The unknown-opcode OOB read described below predates that commit and reaches back to the initial Soft RoCE driver. The check added there reads pkt->paylen < header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE where header_size(pkt) expands to rxe_opcode[pkt->opcode].length. The rxe_opcode[] array has 256 entries but is only populated for defined IB opcodes; any other entry (for example opcode 0xff) is zero-initialized, so length == 0 and the check degenerates to pkt->paylen < 0 + bth_pad(pkt) + RXE_ICRC_SIZE which does not constrain pkt->paylen enough. rxe_icrc_hdr() then computes rxe_opcode[pkt->opcode].length - RXE_BTH_BYTES which underflows when length == 0 and passes a huge value to rxe_crc32(), causing an out-of-bounds read of the skb payload. Reproduced on v7.0-rc7 with that fix applied, QEMU/KVM with CONFIG_RDMA_RXE=y and CONFIG_KASAN=y, after rdma link add rxe0 type rxe netdev eth0 A single 48-byte UDP packet to port 4791 with BTH opcode=0xff and QPN=IB_MULTICAST_QPN triggers: BUG: KASAN: slab-out-of-bounds in crc32_le+0x115/0x170 Read of size 1 at addr ... The buggy address is located 0 bytes to the right of allocated 704-byte region Call Trace: crc32_le+0x115/0x170 rxe_icrc_hdr.isra.0+0x226/0x300 rxe_icrc_check+0x13f/0x3a0 rxe_rcv+0x6e1/0x16e0 rxe_udp_encap_recv+0x20a/0x320 udp_queue_rcv_one_skb+0x7ed/0x12c0 Subsequent packets with the same shape fault on unmapped memory and panic the kernel. The trigger requires only module load and "rdma link add"; no QP, no connection, and no authentication. Fix this by rejecting packets whose opcode has no rxe_opcode[] entry, detected via the zero mask or zero length, before any length arithmetic runs.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.