Executive brief
The Linux kernel's RDMA (Remote Direct Memory Access) networking subsystem fails to validate the size of counter attributes before reading them. An attacker with the ability to send specially crafted netlink messages could cause a kernel crash or potentially execute code by providing malformed attribute data, affecting systems that expose RDMA capabilities.
Technical details
The vulnerability exists in drivers/infiniband/core/nldev.c in the nldev_stat_set_counter_dynamic_doit() function. RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested netlink attribute whose child elements are directly read with nla_get_u32() without validating that each child payload is exactly sizeof(u32) bytes. This missing length check allows an attacker to provide incorrectly-sized attribute data, leading to out-of-bounds reads or buffer overflows. The vulnerability requires local or network access to send netlink messages, depending on system configuration. The fix adds a simple length validation check (nla_len() != sizeof(u32)) before reading each u32 value.
Affected products
- Linux Linux Kernel Linux 5.0+
Timeline
- 2026-09-17: disclosed: CVE-2026-92523 published
- 2026-07-21: patched: Upstream fix commit 74f49255492a62658f36bf2578d7916f1c6ffad1
- 2026-09-14: other: Stable kernel backport merged