Executive brief
A vulnerability was identified in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, which is used for high-speed data transfers between servers. A local user could exploit this flaw to read sensitive information from the system's memory that they should not have access to. This could lead to the exposure of private data or system secrets, potentially aiding further attacks.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's RDMA/uverbs implementation. The function ib_uverbs_post_send() fails to validate the 'wqe_size' parameter provided by userspace before using it in a kmalloc() call. If a user provides a size smaller than the expected 'struct ib_uverbs_send_wr', subsequent kernel operations on the allocated buffer will read beyond its bounds. This allows a local attacker to leak sensitive kernel heap memory to userspace. Additionally, providing an extremely large size can trigger kernel warnings and memory allocation failures. The issue has been resolved by enforcing a minimum size check for 'wqe_size'.
Affected products
- Linux Linux Kernel Fixed in versions 01c9b15, 1956f0a, 9b5ac1c, 9c15ec4, bef70ff, bf1feed, bf4454d, d533425
Timeline
- 2026-01-22: other: Patch authored
- 2026-05-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/01c9b152647dc70dc06a4a2eff86ebb3b3c76075
- https://git.kernel.org/stable/c/1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0
- https://git.kernel.org/stable/c/9b5ac1c15334d46c0dbd49d64a2257b929500163
- https://git.kernel.org/stable/c/9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7
- https://git.kernel.org/stable/c/bef70ff9841990658610512b4a18e4a88c9b4df6
- https://git.kernel.org/stable/c/bf1feed1a7886af945f92890493aefd2b5c9928a
- https://git.kernel.org/stable/c/bf4454da8b1e712714628c0a0d6e7845bb40790a