[SRU][N][PATCH 0/1] CVE-2026-46325

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-46325

[ Impact ]

The RDMA/rxe driver incorrectly handles memory regions (MRs) whose page size
differs from the system PAGE_SIZE. Because rxe_set_page() advances by
mr->page_size increments while the page_list stores individual PAGE_SIZE struct
page pointers, iova-to-va conversion produces an incorrect virtual address
whenever the MR page size is smaller or larger than PAGE_SIZE. This can cause
memory accesses to resolve to the wrong page, leading to data corruption or a
kernel panic, and carries a CVSS score of 9.8.

[ Fix ]

noble: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this change could break iova-to-va translation in the RDMA/rxe
(soft RoCE) driver, resulting in incorrect memory region accesses, data
corruption, or crashes for RDMA workloads. The reworked rxe_mr_page array
indexing and boundary checks could also introduce issues on hosts with non-
default PAGE_SIZE (such as 64K) if the page-size handling is incorrect.