Look up another CVE · open CVE-2026-90435 in the interactive tracker
CVE-2026-90435
RDMA/mlx5: Fix integer overflow of user QP buffer size
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem drivers/infiniband. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90435 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
set_user_buf_size() computes the QP buffer size by left-shifting the user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, which is undefined behavior, and yields a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into. Replace the shifts and addition with check_shl_overflow() and check_add_overflow(), rejecting invalid user inputs. Moreover, guard the identical shift computing qp->sq.offset in _create_user_qp() before set_user_buf_size() is reached.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/infiniband/hw/mlx5/qp.c
- What this is
- MELLANOX MLX5 IB driverMAINTAINERS section matched on drivers/infiniband/hw/mlx5/ · linux-rdma@vger.kernel.org · Supported
- Kernel module
- mlx5_ib
Check it on the machine
grep -wE 'CONFIG_INFINIBAND|CONFIG_MLX5_INFINIBAND' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w mlx5_ibPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormm
- trixieMnot built on armel/rpi
- forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_INFINIBAND, CONFIG_MLX5_INFINIBAND
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/infiniband
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.11 | 5.10.270 | ccce6b7ef1d7 |
| 3.11 | 5.15.221 | d99622e40aaa |
| 3.11 | 6.1.188 | c845e5e05140 |
| 3.11 | 6.6.157 | 42fb8aefffff |
| 3.11 | 6.12.110 | d7fa2ff72ad1 |
| 3.11 | 6.18.52 | 5b6cfc6d7ff0 |
| 3.11 | 7.2.6 | f917707f0de0 |
| 3.11 | 7.3 | dec47e4b0fe3 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The overflowing inputs are mlx5_ib_create_qp.rq_wqe_count and rq_wqe_shift in driver udata, copied by ib_copy_from_udata() in mlx5_ib_create_qp() from a local write/ioctl on /dev/infiniband/uverbsN (IB_USER_VERBS_CMD_CREATE_QP / UVERBS_METHOD_QP_CREATE). A remote RoCE/InfiniBand peer does not supply those fields.
- AC:LAttack complexity, low
- The attacker sets rq_wqe_count and rq_wqe_shift directly. set_rq_size() copies them into qp->rq without bounding wqe_cnt against log_max_qp_sz (only ib_uverbs_ex_create_qp.max_recv_wr is capped), so a small max_recv_wr plus a huge rq_wqe_count reliably overflows the signed wqe_cnt<<wqe_shift in set_user_buf_size() and the sq.offset shift in _create_user_qp().
- PR:LPrivileges required, low
- ib_uverbs_open() and ib_uverbs_alloc_pd() have no capability check, and uverbs_devnode() creates /dev/infiniband/uverbs* as 0666. IB_QPT_RC CREATE_QP does not call rdma_uattrs_has_raw_cap() (that gate is only IB_QPT_RAW_PACKET), so an unprivileged local user with uverbs access can reach the overflow.
- UI:NUser interaction, none
- The attacker opens uverbs, allocates a PD and CQ, and issues CREATE_QP with crafted mlx5_ib_create_qp.rq_wqe_count/rq_wqe_shift. No other user must mount a device, open a file, or confirm the operation.
- S:UScope, unchanged
- The mismatch is between ib_umem_get_attr_or_va() pinning and the same process's mlx5 CREATE_QP WQ programming. Resulting DMA or kernel corruption stays in the host kernel that serves that uverbs file; it is not a guest-to-host or IOMMU cross-VM escape.
- C:HConfidentiality impact, high
- A wrapped wqe_cnt<<wqe_shift produces a small ubuffer.buf_size, so ib_umem_get_attr_or_va() and mlx5_ib_populate_pas() register fewer pages than create_user_qp() programs via log_rq_size/log_rq_stride. The NIC then DMA-reads past the pinned QP buffer, disclosing kernel or other-process memory.
- I:HIntegrity impact, high
- The same undersized PAS versus programmed RQ size lets hardware DMA-write beyond the umem into adjacent physical pages, and a wrapped qp->sq.offset misplaces the send queue in the combined buffer. That is an out-of-bounds write usable for corruption and control-flow hijack.
- A:HAvailability impact, high
- Hardware accessing an RQ larger than the pinned umem, or firmware CREATE_QP with a truncated PAS list, causes IOMMU faults, device errors, or a kernel oops/panic; a negative overflowed buf_size passed to ib_umem_get_attr_or_va() as size_t can also fault during QP setup.