Executive brief
A flaw in the Linux kernel's RDMA irdma driver allows an attacker with local access to overflow a fixed-size page address array by providing user memory with more DMA blocks than expected. This can cause kernel memory corruption, leading to privilege escalation, data exposure, or system crash.
Technical details
This is a classic out-of-bounds write vulnerability in the irdma_copy_user_pgaddrs function. The function copies user-provided page addresses into a fixed 4-entry array (iwmr->pgaddrmem) when operating in level-0 mode, but lacks proper bounds checking. When irdma_setup_pbles is called with lvl==0, the palloc->total_cnt parameter is zero, leaving the loop with no upper bound except the actual DMA block count—allowing writes past the array boundary. An attacker can trigger this via an unprivileged system call to create a malicious user memory region with excess DMA blocks. The patch adds an explicit pbl_len parameter to enforce the maximum number of entries that can be written, preventing the overflow.
Affected products
- Linux Linux kernel Multiple versions via RDMA/irdma driver (patched in stable and upstream)
Timeline
- 2026-08-15: disclosed
- 2026-05-12: patched