Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-74390

RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs The irdma_copy_user_pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc->total_cnt is reached. The issue is that the logic for checking palloc->total_cnt would only work for non-zero values. When irdma_setup_pbles is called with lvl==0, it calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means the only way to break out of the loop is to reach the last umem DMA block, which means it could end up going beyond the fixed size of 4 iwmr->pgaddrmem array that is used in the lvl==0 case. In the case of QP/CQ/SRQ rings, the value of lvl is determined by a separate input (for example, req.cq_pages in the case of a CQ). So, we must perform explicit checking to ensure we don't overflow the pgaddrmem array if the user provides a umem that consists of more blocks than their provided req.cq_pages.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in 4780f58672ee6328accd54a95f9c00683477e499; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in 79a20a8e201a779224b4bf115250a7713bde72c0; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in 9f8f0d2099e3de1194e37dc933ae0c4206b09aaf; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in 192a3be0e3759daa24af2841208b074ca6dbaabc; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in 424d51d33c7541a86934067c2c0538124687fc90; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in abd27a977b419d584efa659488c22d2306987b29; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in 5ebb3ed757be3e04cf803026004aa0beaeb13e9b

  • Linux Linux

    5.14

  • KernelLinux

    From 5.14.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.97; From 6.13.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5

References 7

git.kernel.org