Executive brief
The Linux kernel's RDMA InfiniBand driver (irdma) contains an out-of-bounds memory read vulnerability during Completion Queue memory registration. A flaw in the CQ resize feature flag handling can cause the driver to read one element past the end of an allocated array, potentially exposing kernel memory contents. This affects systems using InfiniBand hardware with the irdma driver enabled.
Technical details
The vulnerability is a classic out-of-bounds read in the irdma_handle_q_mem function. The root cause is that the cqmr->split field, intended to track whether CQ resize is enabled, is not initialized until CQ creation time (after memory registration), so it is always false during memory registration. This causes the code to incorrectly populate cqmr->shadow for GEN_2 and newer hardware. When req->cq_pages equals iwmr->page_cnt (the array size), the assignment cqmr->shadow = (dma_addr_t)arr[req->cq_pages] accesses arr[size], reading one element past the allocated buffer. The fix eliminates the cqmr->split field and directly checks the IRDMA_FEATURE_CQ_RESIZE feature flag. Exploitation requires local access to InfiniBand devices on affected systems; no network attack vector exists. The patch was published upstream and backported to stable kernels.
Affected products
- Linux Linux kernel prior to fix commit 4385ddd654d90245eeb83b3cb539670ab5c85ba4
Timeline
- 2026-08-15: disclosed
- 2026-06-05: patched: upstream fix commit 4385ddd654d90245eeb83b3cb539670ab5c85ba4