Executive brief
A vulnerability was identified in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, which is used for high-speed data transfers between systems. The issue occurs when a user attempts to change memory access permissions from read-only to read-write; if not properly validated, this could allow unauthorized write access to protected memory regions. This could potentially lead to data corruption or unauthorized system modifications by a local attacker.
Technical details
A vulnerability in the Linux kernel RDMA subsystem stems from improper validation during the `rereg_mr` (re-register memory region) operation. When `IB_MR_REREG_ACCESS` is used to transition a memory region from Read-Only (RO) to Read-Write (RW), the underlying `umem` structure was not always re-evaluated to ensure the memory was correctly pinned for write access. This could allow a local attacker to bypass intended memory protections. The fix introduces `ib_umem_check_rereg()` to ensure drivers verify compatibility before applying new access flags. Affected drivers include mlx4, mlx5, hns_roce, irdma, and rxe.
Affected products
- Linux Linux Kernel 6.2 to 7.0.13
Timeline
- 2026-06-15: disclosed: Initial patch authored by Jason Gunthorpe
- 2026-06-19: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-06-19: advisory: CVE-2026-52908 published
References
- https://git.kernel.org/stable/c/09dc18894148381d3bfc550083b1236043870dce
- https://git.kernel.org/stable/c/2904e985a2917b5dac65df82733065e78a65fc9d
- https://git.kernel.org/stable/c/50334a05a950840b39a1ce3d2a173b4183db9b3e
- https://git.kernel.org/stable/c/badad6fad60def1b9805559dd81dbab3d97b82aa
- https://git.kernel.org/stable/c/eba5df21eda0fe7418efbea2f799f8ea1b8ca94c