CVE-2026-93277 (GCVE-0-2026-93277)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:52 – Updated: 2026-09-25 05:09
VLAI
Title
RDMA/bnxt_re: Validate udata before executing commands
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again, even though the driver resource has already been freed. Call ib_no_udata_io() before teardown so udata failures are detected while the resource is still intact, then return success after teardown completes. As part of this change, move ib_respond_empty_udata() to the start of the create and modify flows. While this is not strictly required for general create flows, as the core layer unwinds uobjects on failure, it is necessary for create AH. In _rdma_create_ah(), the HW object is otherwise leaked.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bed686d8dcd4fbcaa18cf67468caaf8772acfc7a , < c5643ea4f040acc2f4d1e88f49bd0be51110ff2f (git)
Affected: bed686d8dcd4fbcaa18cf67468caaf8772acfc7a , < d38c835925d4a3bfdf0a85ff2829ee90c709c561 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/ib_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c5643ea4f040acc2f4d1e88f49bd0be51110ff2f",
              "status": "affected",
              "version": "bed686d8dcd4fbcaa18cf67468caaf8772acfc7a",
              "versionType": "git"
            },
            {
              "lessThan": "d38c835925d4a3bfdf0a85ff2829ee90c709c561",
              "status": "affected",
              "version": "bed686d8dcd4fbcaa18cf67468caaf8772acfc7a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/ib_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Validate udata before executing commands\n\nThe destroy callbacks currently zero the udata output after tearing down\ndriver resources. If the userspace access fails, uverbs preserves the\nuobject and allows the destroy callback to run again, even though the\ndriver resource has already been freed.\n\nCall ib_no_udata_io() before teardown so udata failures are detected\nwhile the resource is still intact, then return success after teardown\ncompletes.\n\nAs part of this change, move ib_respond_empty_udata() to the start of\nthe create and modify flows. While this is not strictly required for\ngeneral create flows, as the core layer unwinds uobjects on failure, it\nis necessary for create AH. In _rdma_create_ah(), the HW object is\notherwise leaked."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled input is the UVERBS_ATTR_UHW_OUT pointer that ib_uverbs_ioctl\u0027s UVERBS_METHOD_INVOKE_WRITE copies into attrs-\u003edriver_udata; bnxt_re_dereg_mr, bnxt_re_dealloc_pd, bnxt_re_destroy_qp, bnxt_re_destroy_cq and bnxt_re_destroy_srq then clear_user that buffer via ib_respond_empty_udata after teardown. RoCE receive never supplies that udata.\nAC:L - Mapping a PROT_READ/PROT_NONE page and passing it as UHW_OUT on INVOKE_WRITE IB_USER_VERBS_CMD_DEREG_MR (or DEALLOC_PD/DESTROY_QP/CQ/SRQ) makes ib_respond_empty_udata\u0027s clear_user fail after bnxt_re_dereg_mr kfree(mr); uverbs_destroy_uobject then keeps uobj-\u003eobject and a second destroy or close() retries destroy_hw. No race or layout the attacker cannot arrange.\nPR:L - uverbs_devnode() creates /dev/infiniband/uverbs* mode 0666 and ib_uverbs_open() only checks rdma_dev_access_netns(), so an unprivileged process can GET_CONTEXT, REG_MR, then INVOKE_WRITE DEREG_MR without CAP_SYS_ADMIN or init-namespace root.\nUI:N - The attacker opens their own uverbs fd, creates an MR/PD/QP/CQ/SRQ, then issues INVOKE_WRITE destroy with a non-writable UHW_OUT and a follow-up destroy or close(); no other user must mount, open, or click.\nS:U - The double-free is of the host kernel\u0027s bnxt_re_mr (kfree in bnxt_re_dereg_mr) and related driver objects (fence-\u003emr, cq-\u003ecql, umem). It is local privilege escalation and does not cross a VM, IOMMU, or guest-to-host boundary.\nC:H - bnxt_re_dereg_mr kfree(mr) then returns -EFAULT from ib_respond_empty_udata, so uobj-\u003eobject still points at the freed bnxt_re_mr; the second destroy_hw walks that slab, and reclaiming it yields an arbitrary kernel read.\nI:H - The same preserved uobject lets the attacker spray the freed bnxt_re_mr (and fence-\u003emr from bnxt_re_destroy_fence_mr on PD destroy, or cq-\u003ecql from bnxt_re_destroy_cq) and hijack the second destroy_hw/kfree, which is an arbitrary write and control-flow primitive.\nA:H - Retrying destroy or closing the uverbs fd after the failed ib_respond_empty_udata double-frees mr/cql/umem and re-enters bnxt_qplib_destroy_qp/cq/srq on already-destroyed firmware objects, which oopses or panics the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:09:56.815Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c5643ea4f040acc2f4d1e88f49bd0be51110ff2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d38c835925d4a3bfdf0a85ff2829ee90c709c561"
        }
      ],
      "title": "RDMA/bnxt_re: Validate udata before executing commands",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93277",
    "datePublished": "2026-09-24T15:52:19.490Z",
    "dateReserved": "2026-09-17T16:02:15.098Z",
    "dateUpdated": "2026-09-25T05:09:56.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93277",
      "date": "2026-09-25",
      "epss": "0.00143",
      "percentile": "0.02991"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/bnxt_re/ib_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c5643ea4f040acc2f4d1e88f49bd0be51110ff2f",
                    "status": "affected",
                    "version": "bed686d8dcd4fbcaa18cf67468caaf8772acfc7a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d38c835925d4a3bfdf0a85ff2829ee90c709c561",
                    "status": "affected",
                    "version": "bed686d8dcd4fbcaa18cf67468caaf8772acfc7a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/bnxt_re/ib_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Validate udata before executing commands\n\nThe destroy callbacks currently zero the udata output after tearing down\ndriver resources. If the userspace access fails, uverbs preserves the\nuobject and allows the destroy callback to run again, even though the\ndriver resource has already been freed.\n\nCall ib_no_udata_io() before teardown so udata failures are detected\nwhile the resource is still intact, then return success after teardown\ncompletes.\n\nAs part of this change, move ib_respond_empty_udata() to the start of\nthe create and modify flows. While this is not strictly required for\ngeneral create flows, as the core layer unwinds uobjects on failure, it\nis necessary for create AH. In _rdma_create_ah(), the HW object is\notherwise leaked."
          }
        ],
        "id": "CVE-2026-93277",
        "lastModified": "2026-09-25T05:17:01.507",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T16:17:24.907",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c5643ea4f040acc2f4d1e88f49bd0be51110ff2f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d38c835925d4a3bfdf0a85ff2829ee90c709c561"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-24T23:48:29Z",
      "cve": "CVE-2026-93277",
      "id": "CVE-2026-93277",
      "initial_release_date": "2026-09-24T23:48:29Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93277",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93277.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.