CVE-2026-97421 (GCVE-0-2026-97421)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 05:10
VLAI
Title
RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Several corner cases, especially important on 32 bits: - umem->iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the length is not too large for the iova - Check that lengths > 4G don't overflow the GENMASK
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ae3cf7d2c4d506c5c91746321644e1a08d989e2a (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5fc5b73109540809b094710fac44da81dd8a3ff8 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 09ea6837a0434fb4db99528a5055b6d822135dcf (git)
Affected: 0 , < 6.12.111 (semver)
Affected: 0 , < 6.18.53 (semver)
guessed Create a notification for this product.
Linux Linux Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/umem.c",
            "include/rdma/ib_umem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae3cf7d2c4d506c5c91746321644e1a08d989e2a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5fc5b73109540809b094710fac44da81dd8a3ff8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "09ea6837a0434fb4db99528a5055b6d822135dcf",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.111",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/umem.c",
            "include/rdma/ib_umem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()\n\nSeveral corner cases, especially important on 32 bits:\n\n- umem-\u003eiova is u64, the function argument should pass in u64 or\n  iova will be truncated\n- Check that the length is not too large for the iova\n- Check that lengths \u003e 4G don\u0027t overflow the GENMASK"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Attacker-controlled cmd.hca_va and cmd.length reach ib_umem_find_best_pgsz() via open of /dev/infiniband/uverbsX, then ib_uverbs_write(IB_USER_VERBS_CMD_REG_MR)/ib_uverbs_reg_mr() or UVERBS_METHOD_REG_MR ioctl, then pd-\u003eops.reg_user_mr() (mlx5_ib_reg_user_mr/irdma_reg_user_mr/efa_register_mr). Remote RDMA packets do not supply virt or umem-\u003elength.\nAC:L - ib_uverbs_reg_mr() only requires (start \u0026 ~PAGE_MASK)==(hca_va \u0026 ~PAGE_MASK), so the attacker picks hca_va near 2^63 or U64_MAX with a small pinned region and makes (umem-\u003elength-1+virt) overflow or bits_per() return BITS_PER_LONG, hitting the unguarded GENMASK() deterministically with no race.\nPR:L - uverbs_devnode() creates /dev/infiniband/uverbs* mode 0666 and ib_uverbs_open() has no capability check (only rdma_dev_access_netns). ib_umem_get_va() needs can_do_mlock() (RLIMIT_MEMLOCK!=0) and ib_check_mr_access(); CAP_SYS_ADMIN/CAP_IPC_LOCK are not required.\nUI:N - After opening uverbs the attacker allocates a PD and issues IB_USER_VERBS_CMD_REG_MR or UVERBS_METHOD_REG_MR with their own start, length, and hca_va; no victim mount or other user action is required.\nS:U - A wrong page size or truncated umem-\u003eiova from ib_umem_find_best_pgsz() misprograms that host\u0027s RDMA MTT/PBL. This stays in the kernel/device memory-management authority and is not a KVM/Xen guest-to-host escape or IOMMU VM-boundary bypass.\nC:H - When bits_per((umem-\u003elength-1+virt)^virt)\u003e=BITS_PER_LONG, GENMASK(BITS_PER_LONG-1, bits) is invalid and mask can be 0, so the function returns rounddown_pow_of_two(pgsz_bitmap) (largest HW page). mlx5_ib_populate_pas()/rdma_umem_for_each_dma_block() then install oversized MTT/PBL entries, so the NIC DMA-reads physical memory beyond the pinned umem.\nI:H - The same oversized page size is programmed into hardware (efa_register_mr params.page_shift, ionic_pgtbl_init, mlx5 mkey PAS). With IB_ACCESS_LOCAL_WRITE or IB_ACCESS_REMOTE_WRITE from the REG_MR access_flags, the device DMA-writes outside the registered region, which is an arbitrary physical write.\nA:H - GENMASK() with l\u003eh is a shift UB that can oops (UBSAN) or yield mask==0; mis-sized pages cause IOMMU/device faults. ib_umem_is_contiguous() (mlx5_ib_db_map_user_desc, efa create_cq) can also treat a non-contiguous umem as one DMA block and fault the kernel or NIC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:10:30.134Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae3cf7d2c4d506c5c91746321644e1a08d989e2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fc5b73109540809b094710fac44da81dd8a3ff8"
        },
        {
          "url": "https://git.kernel.org/stable/c/09ea6837a0434fb4db99528a5055b6d822135dcf"
        }
      ],
      "title": "RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97421",
    "datePublished": "2026-09-24T16:03:31.505Z",
    "dateReserved": "2026-09-24T14:53:16.868Z",
    "dateUpdated": "2026-09-25T05:10:30.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/core/umem.c",
                  "include/rdma/ib_umem.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ae3cf7d2c4d506c5c91746321644e1a08d989e2a",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5fc5b73109540809b094710fac44da81dd8a3ff8",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "09ea6837a0434fb4db99528a5055b6d822135dcf",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.12.111",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.53",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/core/umem.c",
                  "include/rdma/ib_umem.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()\n\nSeveral corner cases, especially important on 32 bits:\n\n- umem-\u003eiova is u64, the function argument should pass in u64 or\n  iova will be truncated\n- Check that the length is not too large for the iova\n- Check that lengths \u003e 4G don\u0027t overflow the GENMASK"
          }
        ],
        "id": "CVE-2026-97421",
        "lastModified": "2026-09-24T17:17:19.993",
        "metrics": {},
        "published": "2026-09-24T17:17:19.993",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/09ea6837a0434fb4db99528a5055b6d822135dcf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5fc5b73109540809b094710fac44da81dd8a3ff8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae3cf7d2c4d506c5c91746321644e1a08d989e2a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.