The rxe RDMA driver contains a time-of-check-time-of-use vulnerability in its Shared Receive Queue (SRQ) path. The driver reads the num_sge field from userspace to validate it against bounds, then re-reads the same field to calculate memcpy length for copying wqe data. A malicious userspace thread can modify num_sge between those two reads, turning a validated-safe operation into a heap overflow. The fix is straightforward—cache num_sge locally after the first read—but this triviality is itself instructive: it reflects a systemic pattern failure rather than developer incompetence.
What makes this more than a one-off is the SRQ attack surface. SRQs exist specifically to enable multiple Queue Pairs to consume from a shared receive queue, which means this TOCTOU isn't just a self-race within one process—it's a cross-process memory corruption vector. An attacker who compromises one process on an RDMA fabric can potentially corrupt shared fabric state that influences QP transitions, credit accounting, and completion queue events. This elevates the severity beyond local heap corruption into territory that affects the RDMA fabric's internal bookkeeping.
The CVSS 7.8 likely understates practical risk in production environments. RDMA deployments cluster in high-stakes infrastructure: HPC clusters running distributed ML training, financial HFT systems, storage backends. Successful exploitation in those contexts has collateral damage that CVSS doesn't capture. Additionally, rxe is the software RDMA implementation—the fallback path used when hardware RDMA isn't available. This population receives less stress-testing for concurrent modification patterns because users who need performance use hardware RDMA. The code sits at the intersection of 'RDMA' and 'software implementation,' reviewed by neither the RDMA specialists nor the general kernel community.
To verify if you're affected: check the kernel version running rxe (kernel 6.12+ should contain the fix), review any SRQ creation paths in userspace code that interact with the driver, and audit for other locations where userspace-controlled fields are read multiple times without local caching. The pattern—read, validate, re-read—should be flagged in any RDMA driver code review. Consider adding static analysis rules or kernel helper functions that enforce single-read semantics for userspace fields used in both validation and operation, making TOCTOU structurally impossible rather than a discipline developers must remember.