Executive brief
A vulnerability was identified in the Linux kernel's RDMA (Remote Direct Memory Access) component. The system failed to properly validate that certain data strings sent from user applications were correctly terminated. This could potentially lead to system instability or memory-related issues when the kernel processes malformed network management messages.
Technical details
A vulnerability exists in the RDMA/core component of the Linux kernel, specifically within the iWARP Port Mapper (iwpm_msg.c). The netlink attribute policy used NLA_STRING for attributes like IWPM_NLA_RREG_IBDEV_NAME and IWPM_NLA_RREG_ULIB_NAME, which does not guarantee a null terminator. When these attributes are subsequently processed by functions like strcmp() or printf with %s, an attacker providing a non-terminated string could trigger an out-of-bounds read. The fix involves migrating these attributes to NLA_NUL_STRING to ensure the kernel enforces the presence of a null terminator. This issue primarily affects local users or applications interacting with the RDMA subsystem via netlink.
Affected products
- Linux Linux Kernel 3.16 to 6.13.y
Timeline
- 2026-07-19: advisory: NVD publication date
- 2026-04-09: patched: Initial patch commit in Linux kernel master branch
References
- https://git.kernel.org/stable/c/137b5918931d4d05aa8ea8d3adf67f7224eef63c
- https://git.kernel.org/stable/c/5877c043398d5fa0e93919a3d837e5cd7a98a961
- https://git.kernel.org/stable/c/6ed3d14fc45d3da6025e7fe4a6a09066856698e2
- https://git.kernel.org/stable/c/87111356d58d86edb221ba144d261ed83a5b8bbe
- https://git.kernel.org/stable/c/abda65bdd13084c771842adaac1f652d0660dd82
- https://git.kernel.org/stable/c/c26a0052cceed4c4d380ee5808b699f937fb58d8
- https://git.kernel.org/stable/c/f2c7b39dde2e61df8157066969cc2a408cd3dcd9