CVE-2026-46043 (CVSS 9.1)

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE.

Is your site exposed to CVE-2026-46043?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS — Exploit Prediction

0.0052

Probability of exploitation

0.40%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/2c0d71ef12f46c57d37bc571f3f2797db7eb50cc https://git.kernel.org/stable/c/2fd4f8b749309a61c3f3f88ee8891d94f79e1240 https://git.kernel.org/stable/c/5fedefec757192dcaad29a664ac332c7601be144 https://git.kernel.org/stable/c/7244491dab347f648e661da96dc0febadd9daec3 https://git.kernel.org/stable/c/9b924f3a26b21330a837cfe72e819b6393bbeeaa https://git.kernel.org/stable/c/c4376c672c3648d5bdc31dfffc329d07164f93c4 https://git.kernel.org/stable/c/e8ee0e792d475b1067c199ef0af1b6221fa6f43d https://git.kernel.org/stable/c/f83519a4c122c9c7a850a2197648a9ff4c67c520

Frequently Asked Questions

What is CVE-2026-46043? +

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE. It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2026-46043? +

CVE-2026-46043 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0052, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-46043? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-46043