{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access  mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic:      if (iova \u003c mr-\u003eibmr.iova ||         iova + length \u003e mr-\u003eibmr.iova + mr-\u003eibmr.length)  A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr-\u003epage_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer.  Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow:      if (iova \u003c mr-\u003eibmr.iova ||         length \u003e mr-\u003eibmr.length ||         iova - mr-\u003eibmr.iova \u003e mr-\u003eibmr.length - length)  With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.",
  "id": "DEBIAN-CVE-2026-98365",
  "modified": "2026-10-07T04:47:41.247303849Z",
  "published": "2026-10-06T09:18:30.677Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98365"
    }
  ],
  "upstream": [
    "CVE-2026-98365"
  ]
}