EUVD-2026-59537
GHSA-c23v-2w7h-h6m9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges to RDMA uverbs interface suffices; no complexity or interaction required; kernel heap write yields full High C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
The irdma_copy_user_pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc->total_cnt is reached. The issue is that the logic for checking palloc->total_cnt would only work for non-zero values.
When irdma_setup_pbles is called with lvl0, it calls irdma_copy_user_pgaddrs with palloc->total_cnt0, which means the only way to break out of the loop is to reach the last umem DMA block, which means it could end up going beyond the fixed size of 4 iwmr->pgaddrmem array that is used in the lvl==0 case.
In the case of QP/CQ/SRQ rings, the value of lvl is determined by a separate input (for example, req.cq_pages in the case of a CQ). So, we must perform explicit checking to ensure we don't overflow the pgaddrmem array if the user provides a umem that consists of more blocks than their provided req.cq_pages.
AnalysisAI
Out-of-bounds write in the Linux kernel's RDMA irdma driver allows a local low-privileged user to overflow a fixed-size kernel array and corrupt heap memory, potentially escalating privileges or crashing the system. The flaw exists in irdma_copy_user_pgaddrs, where the loop guard based on palloc->total_cnt is inert when set to zero (the lvl==0 path), allowing a user-supplied umem with more than 4 DMA blocks to write beyond the 4-entry iwmr->pgaddrmem array. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Intel irdma kernel module must be loaded, which requires an Intel RDMA-capable Ethernet adapter (E810 or X722 series) to be physically present and the driver active - systems without this hardware are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes local, low-privilege exploitation with High impact across all three impact dimensions, consistent with a kernel heap corruption primitive that can be leveraged for privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a system with an Intel E810 or X722 adapter and the irdma driver loaded opens an RDMA completion queue (CQ) specifying a small req.cq_pages value (e.g., 1), then registers an underlying umem object backed by more than 4 DMA blocks. When the kernel processes this registration via the lvl==0 path, irdma_copy_user_pgaddrs iterates all DMA blocks without bound, writing page addresses beyond the 4-entry pgaddrmem array and corrupting adjacent kernel heap memory. … |
| Remediation | Upgrade the Linux kernel to the patched version for the running stable branch: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running RDMA-enabled Linux kernel instances and determine affected versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today