Executive brief
A vulnerability was identified in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem that occurs when handling very large memory blocks (4GB or larger). This issue could lead to the system calculating incorrect memory addresses, potentially causing system instability or data corruption during high-performance networking operations. The flaw primarily affects systems using IOMMU for memory mapping linearization.
Technical details
A truncation vulnerability exists in the Linux kernel RDMA/umem subsystem within the `__rdma_block_iter_next()` function. When the IOMMU is used, the linearization of memory mappings can result in single blocks exceeding 4GB being split across multiple scatter-gather (SG) entries. The function used 32-bit stack variables (`unsigned int`) to reassemble these entries, leading to an integer overflow and subsequent calculation of incorrect DMA addresses for blocks following the truncation. The fix involves using the `dma_addr_t` type to properly accommodate 64-bit addresses. This issue affects kernels from version 5.2 onwards and has been patched in various stable branches.
Affected products
- Linux Linux Kernel 5.2 to 5.10.259, 5.15.210, 6.1.176, and others
Timeline
- 2026-06-01: other: Initial patch authored by Jason Gunthorpe
- 2026-06-25: advisory: CVE published to NVD
References
- https://git.kernel.org/stable/c/15fe76e23615f502d051ef0768f86babaf08746c
- https://git.kernel.org/stable/c/2ff4b7817e5b78070c30f5fb5e678e452a2628b3
- https://git.kernel.org/stable/c/8fe0231adebe086c8a459c790944ac026cd99c6e
- https://git.kernel.org/stable/c/ac1aad8e1281534ce936c250f68084fc79c5469e
- https://git.kernel.org/stable/c/afd35fec9297195b759078745549c2671223f24f
- https://git.kernel.org/stable/c/baf8685bcf56dc1efb44b8f6a57c42516e549068
- https://git.kernel.org/stable/c/cc644d5608e3b0dadc970bd6e6aa26b91ea07d0f