[Linux RDMA/rxe] From kref_get to root: exploitation of CVE-2026-64582
nasm.re discovered and exploited a use-after-free vulnerability in the Linux kernel's Soft-RoCE (RXE) RDMA driver in rxe_mmap. A race condition between the mmap handler and CQ destruction allows a UAF on a struct rxe_mmap_info object in kmalloc-64. The researcher extended the race window using a timerfd-based waitqueue technique (from Project Zero), used a keyring-based oracle to detect UAF success, and converted the UAF into a reliable refcount increment primitive triggered by fork(). This was chained with the Dirty pageflags technique to corrupt a PTE from read-only to writable, enabling write to /etc/passwd for local privilege escalation to root. The exploit was demonstrated on Linux 7.2-rc1 with several kernel hardening features disabled. The researcher submitted a patch using kref_get_unless_zero, which was merged upstream in commit 35744ab3d03c5fca8c1752f53fc8fc674e14c561.
Research notes
- Root causeA race condition between rxe_mmap and CQ destruction allows a use-after-free on struct rxe_mmap_info because the destroy code path lacks locking, allowing concurrent kref_put while the mmap handler is still accessing the object.
- Technical detailThe researcher extended the race window using a timerfd-based waitqueue technique (from Project Zero) to delay vfree until remap_vmalloc_range completes, avoiding a GPF and enabling reliable UAF triggering.
- Technical detailA keyring-based oracle was used to detect UAF success: keys of KEY_PAYLOAD_SIZE (40 bytes) are allocated in kmalloc-64 to occupy the freed victim object, then fork() triggers kref_get on the victim, and the key payload is read to check for the refcount increment.
- Exploit chainThe UAF is converted into a reliable refcount increment primitive (every fork() bumps a refcount on an object in kmalloc-64), then chained with the Dirty pageflags technique to corrupt a PTE from read-only to writable, enabling write to /etc/passwd for local privilege escalation to root.
- PoC researchThe exploit was demonstrated on Linux 7.2-rc1 and the exploit code is publicly available on GitHub Gist.
- MitigationThe researcher submitted a patch using kref_get_unless_zero to hold the lock and check whether the object is being freed, preventing the UAF. The patch was merged upstream in commit 35744ab3d03c5fca8c1752f53fc8fc674e14c561.