Executive brief
The Linux kernel's RDMA HFI1 driver handles high-speed InfiniBand network communications. A flaw in the SDMA (Software DMA) transmission initialization code fails to check for errors, allowing corrupted or uninitialized requests to proceed as valid, potentially causing denial of service or data corruption on systems using this network hardware.
Technical details
The vulnerability is a missing error check in the set_txreq_header_ahg() function within the HFI1 user SDMA driver (drivers/infiniband/hw/hfi1/user_sdma.c). The function calls sdma_txinit_ahg() but ignores its return value; if the function fails, the transmit request structure (tx->txreq) is not initialized, but set_txreq_header_ahg() returns success anyway, causing the caller to process an invalid request. The attack vector is local, requiring access to the RDMA interface. The fix captures the return value and propagates errors to the caller, aborting request processing on failure. Patches are available in upstream Linux and stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions prior to fix (commit 091c6162c022cbdfb64219708a71728cfd1d4600)
Timeline
- 2026-09-17: disclosed: CVE-2026-93037 published
- 2026-07-20: patched: Fix merged upstream by Leon Romanovsky (commit 091c6162c022cbdfb64219708a71728cfd1d4600)
- 2026-09-14: patched: Fix backported to stable kernels by Greg Kroah-Hartman