Look up another CVE · open CVE-2026-97421 in the interactive tracker
CVE-2026-97421
RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
Published 2026-09-24 (24 days ago) by the Linux kernel CNA. Subsystem drivers/infiniband. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-97421 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Several corner cases, especially important on 32 bits: - umem->iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the length is not too large for the iova - Check that lengths > 4G don't overflow the GENMASK
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/infiniband/core/umem.c
include/rdma/ib_umem.h
- What this is
- INFINIBAND SUBSYSTEMMAINTAINERS section matched on drivers/infiniband/ · linux-rdma@vger.kernel.org · Supported
- Kernel module
- ib_core
Check it on the machine
grep -wE 'CONFIG_INFINIBAND|CONFIG_INFINIBAND_USER_ACCESS|CONFIG_INFINIBAND_USER_MEM' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ib_corePrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_INFINIBAND, CONFIG_INFINIBAND_USER_ACCESS, CONFIG_INFINIBAND_USER_MEM
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-24 (24 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/infiniband
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10 | 5.15.222 | 3014da7587ce |
| 5.10 | 6.1.189 | ddccf6cc3861 |
| 5.10 | 6.6.158 | e9bbb5f5349e |
| 5.10 | 6.12.111 | ae3cf7d2c4d5 |
| 5.10 | 6.18.53 | 5fc5b7310954 |
| 5.10 | 7.2 | 09ea6837a043 |
| 5.4.73 | 0 | 0 |
| 5.8.17 | 0 | 0 |
| 5.9.2 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Attacker-controlled cmd.hca_va and cmd.length reach ib_umem_find_best_pgsz() via open of /dev/infiniband/uverbsX, then ib_uverbs_write(IB_USER_VERBS_CMD_REG_MR)/ib_uverbs_reg_mr() or UVERBS_METHOD_REG_MR ioctl, then pd->ops.reg_user_mr() (mlx5_ib_reg_user_mr/irdma_reg_user_mr/efa_register_mr). Remote RDMA packets do not supply virt or umem->length.
- AC:LAttack complexity, low
- ib_uverbs_reg_mr() only requires (start & ~PAGE_MASK)==(hca_va & ~PAGE_MASK), so the attacker picks hca_va near 2^63 or U64_MAX with a small pinned region and makes (umem->length-1+virt) overflow or bits_per() return BITS_PER_LONG, hitting the unguarded GENMASK() deterministically with no race.
- PR:LPrivileges required, low
- uverbs_devnode() creates /dev/infiniband/uverbs* mode 0666 and ib_uverbs_open() has no capability check (only rdma_dev_access_netns). ib_umem_get_va() needs can_do_mlock() (RLIMIT_MEMLOCK!=0) and ib_check_mr_access(); CAP_SYS_ADMIN/CAP_IPC_LOCK are not required.
- UI:NUser interaction, none
- After opening uverbs the attacker allocates a PD and issues IB_USER_VERBS_CMD_REG_MR or UVERBS_METHOD_REG_MR with their own start, length, and hca_va; no victim mount or other user action is required.
- S:UScope, unchanged
- A wrong page size or truncated umem->iova from ib_umem_find_best_pgsz() misprograms that host's RDMA MTT/PBL. This stays in the kernel/device memory-management authority and is not a KVM/Xen guest-to-host escape or IOMMU VM-boundary bypass.
- C:HConfidentiality impact, high
- When bits_per((umem->length-1+virt)^virt)>=BITS_PER_LONG, GENMASK(BITS_PER_LONG-1, bits) is invalid and mask can be 0, so the function returns rounddown_pow_of_two(pgsz_bitmap) (largest HW page). mlx5_ib_populate_pas()/rdma_umem_for_each_dma_block() then install oversized MTT/PBL entries, so the NIC DMA-reads physical memory beyond the pinned umem.
- I:HIntegrity impact, high
- The same oversized page size is programmed into hardware (efa_register_mr params.page_shift, ionic_pgtbl_init, mlx5 mkey PAS). With IB_ACCESS_LOCAL_WRITE or IB_ACCESS_REMOTE_WRITE from the REG_MR access_flags, the device DMA-writes outside the registered region, which is an arbitrary physical write.
- A:HAvailability impact, high
- GENMASK() with l>h is a shift UB that can oops (UBSAN) or yield mask==0; mis-sized pages cause IOMMU/device faults. ib_umem_is_contiguous() (mlx5_ib_db_map_user_desc, efa create_cq) can also treat a non-contiguous umem as one DMA block and fault the kernel or NIC.