Executive brief
The Linux kernel's mlx5 RDMA driver computes queue pair (QP) buffer sizes using left-shift operations on user-supplied values without overflow checks. An attacker with local access can provide crafted input values that cause integer overflow, resulting in a smaller-than-expected buffer allocation. This allows the hardware to write beyond the allocated memory boundary, potentially causing data corruption, denial of service, or privilege escalation.
Technical details
The vulnerability is an integer overflow in the set_user_buf_size() function within drivers/infiniband/hw/mlx5/qp.c. The code performs left-shift operations (<<) on user-controlled rq.wqe_cnt and rq.wqe_shift values as signed integers without validation. A sufficiently large rq.wqe_cnt causes signed integer overflow, yielding a small or negative buf_size that is then passed to ib_umem_get(), which maps a buffer smaller than the hardware will actually write into. The fix replaces unsafe shifts with check_shl_overflow() and check_add_overflow() macros that validate operations and reject invalid inputs. An additional overflow check was added in _create_user_qp() to guard computation of qp->sq.offset. Attack requires local access to invoke the vulnerable ioctl interface.
Affected products
- Linux Linux kernel multiple versions via mlx5 RDMA driver
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Patch committed upstream; backported to stable branches