Executive brief
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) component could allow a local user to crash the system. By providing an invalid processor ID during certain memory allocation requests, an attacker can trigger a system reboot or cause the kernel to read memory outside of intended boundaries. This affects systems using RDMA for high-performance networking and storage.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel RDMA core within the DMAH (Direct Memory Access Handle) allocation path. The 'cpu_id' attribute provided by userspace via UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu() without bounds checking against 'nr_cpu_ids'. This results in an out-of-bounds read of the cpumask bitmap. On kernels configured with CONFIG_DEBUG_PER_CPU_MAPS and panic_on_warn, this can be leveraged to trigger a kernel panic and subsequent machine reboot. The issue has been resolved by validating the cpu_id against nr_cpu_ids before use.
Affected products
- Linux Linux Kernel 6.17 to 7.1
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory