7.3

CVE-2026-80864: linux

CVSS: 7.3v4.0HighReceived
AliasesUBUNTU-CVE-2026-80864DEBIAN-CVE-2026-80864
Published 04-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-80864 is a high (CVSS 7.3) vulnerability in linux. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.3% of scored vulnerabilities.

Overall risk
29/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.3/10
010
High · v4.0 (OSV · Ubuntu), selected by version preference
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 9
MGASA-2026-0506OPENSUSE-SU-2026:11773-1OPENSUSE-SU-2026:22091-1RHSA-2026:77216RHSA-2026:77217RHSA-2026:77218

Timeline

  1. 04-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while the responder task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting only that attribute calls free_rd_atomic_resources() then alloc_rd_atomic_resources(), swapping qp->resp.resources[] while rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources() also leaves the cached pointer qp->resp.res dangling. A local unprivileged user can race the free/realloc into a use-after-free in rxe_receiver() (local DoS). Drain recv_task around the swap with rxe_disable_task()/rxe_enable_task(), as rxe_qp_reset() already does when tearing this array down, re-enabling only after alloc_rd_atomic_resources() succeeds so the responder never resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear qp->resp.res in free_rd_atomic_resources(), like the rxe_resp.c completion paths. Reproduced under KASAN; the slab-use-after-free in rxe_receiver() is gone.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

0.00 pp

From 0.16% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu168 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.12.111-1 | < 7.1.13-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < 0136b528b753c5a56e4d997ef20b86bb6750b8fb | ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < ffa4f0be69656be1755090f02db38d49816585c6 | ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < d4cd32eb8bd2b0ffbdc7b1f3d82ce6a371f8f844 | ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < 60dfd47929cd1e7070daa810d40ce538d888410d | ≥ 8700e3e7c4857d28ebaa824509934556da0b3e76, < 6f7014237405e7f032b5c53a82d9eccf6161c291 | 4.8

3 vendors · 171 products

References

9 links