{"id":33430,"date":"2026-10-06T20:31:59","date_gmt":"2026-10-06T12:31:59","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98361"},"modified":"2026-10-06T20:31:59","modified_gmt":"2026-10-06T12:31:59","slug":"cve-2026-98361","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98361","title":{"rendered":"CVE-2026-98361 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA\/rxe: Restore HMM"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>RDMA\/rxe: Restore HMM_PFN_WRITE check in ODP write paths<\/p>\n<p>Commit 0b261d7c1cd3 (&#8220;RDMA\/rxe: Break endless pagefault loop for RO<br \/>\npages&#8221;) dropped the access permission test from rxe_check_pagefault()<br \/>\nand left only HMM_PFN_VALID. A page faulted in read-only, for example<br \/>\na page-cache folio behind a PROT_READ file mapping, then satisfies the<br \/>\ncheck and ODP write operations (RDMA WRITE, RDMA READ response, SEND<br \/>\npayload, atomics) modify it through kmap without ever breaking CoW.<\/p>\n<p>An unprivileged user can register an ODP MR over such a mapping and<br \/>\nhave incoming RDMA traffic overwrite the page cache of a file it only<br \/>\nholds O_RDONLY, including \/etc\/passwd or setuid binaries. This is the<br \/>\nsame primitive class as Dirty COW and CVE-2022-2590.<\/p>\n<p>mlx5 has the missing invariant: its ODP path sets the device write bit<br \/>\nonly for pfns that carry HMM_PFN_WRITE. Restore it in rxe by requiring<br \/>\nHMM_PFN_WRITE in rxe_check_pagefault() for every operation except<br \/>\nRXE_PAGEFAULT_RDONLY. A write to a non-writable VMA now fails the one<br \/>\nfault attempt with -EPERM from hmm_vma_fault() instead of re-faulting<br \/>\nforever. For a writable VMA the fault breaks CoW and the write lands<br \/>\nin the private page.<\/p>\n<p>Keep pmem flushes on the read-only check. arch_wb_cache_pmem() never<br \/>\nmodifies memory, and the FLUSH access bits do not make the umem<br \/>\nwritable, so classifying flushes as writes would make every flush<br \/>\nagainst a flush-only MR fail.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>RDMA\/rxe: Restore HMM_PFN_WRITE check in ODP write paths<\/p>\n<p>Commit 0b261d7c1cd3 (&#8220;RDMA\/rxe: Break endless pagefault loop for RO<br \/>\npages<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33430","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}