https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 20:49:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90435 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>RDMA/mlx5: Fix integer overflow of user QP buffer size</p> <p>set_user_buf_size() computes the QP buffer size by left-shifting the user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, which is undefined behavior, and yields a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into.</p> <p>Replace the shifts and addition with check_shl_overflow() and check_add_overflow(), rejecting invalid user inputs.</p> <p>Moreover, guard the identical shift computing qp-&gt;sq.offset in _create_user_qp() before set_user_buf_size() is reached.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>RDMA/mlx5: Fix integer overflow of user QP buffer size</p> <p>set_user_buf_size() computes the QP buffer size by left-shifting the user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, which is undefined behavior, and yields a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into.</p> <p>Replace the shifts and addition with check_shl_overflow() and check_add_overflow(), rejecting invalid user inputs.</p> <p>Moreover, guard the identical shift computing qp-&gt;sq.offset in _create_user_qp() before set_user_buf_size() is reached.</p> https://vulnerability.circl.lu/vuln/cve-2026-90435