Skip to main content

Linux Kernel EUVDEUVD-2026-38037

| CVE-2026-52908 HIGH
2026-06-19 Linux GHSA-2m6m-r8c9-84hh
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local RDMA verbs access with low privileges and no user interaction yields PR:L/AV:L; RO-to-RW mispin enables memory corruption giving high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.8 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 10:30 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 19, 2026 - 16:01 EUVD
CVE Published
Jun 19, 2026 - 14:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 19, 2026 - 14:00 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA: During rereg_mr ensure that REREG_ACCESS is compatible

If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be re-evaluated to ensure it is properly pinned as RW. Since the umem is hidden inside each driver's mr struct add a ib_umem_check_rereg() function that each driver has to call before processing IB_MR_REREG_ACCESS.

mlx4 has to retain its duplicate ib_access_writable check because it implements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items in place sequentially while the MR is live, so it will continue to not support this combination.

AnalysisAI

Improper access-control re-validation in the Linux kernel's RDMA/InfiniBand subsystem (the ib_uverbs memory-region re-registration path) allows a local user with RDMA device access to obtain unintended read-write access to memory that was only pinned as read-only. When IB_MR_REREG_ACCESS upgrades a memory region from RO to RW, the underlying umem was not re-evaluated to confirm it is properly pinned for writing, enabling potential memory corruption or disclosure across RDMA-capable drivers. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the issue is fixed upstream in multiple stable trees.

Technical ContextAI

The flaw lives in the kernel's RDMA (Remote Direct Memory Access) verbs layer, specifically the user-facing memory-region re-registration operation (rereg_mr) exposed through the ib_uverbs interface. RDMA memory regions wrap a pinned user-memory area (umem) whose page mappings are GUP-pinned with permissions matching the access flags requested at registration. Because the umem is stored privately inside each hardware driver's mr structure (mlx4, mlx5, and others), there was no common guard ensuring that an access-flag change from read-only to read-write triggered re-pinning of the pages as writable. The fix introduces a shared ib_umem_check_rereg() helper that every driver must invoke before honoring IB_MR_REREG_ACCESS; mlx4 additionally keeps its existing ib_access_writable check because it mutates access and translation in place on a live MR and therefore still refuses the combined REREG_ACCESS|REREG_TRANS case. The CWE is not assigned in the input, but the root cause is an improper-permission/access-control re-validation issue (incorrect handling of RO-to-RW privilege upgrade on pinned memory).

RemediationAI

Apply the vendor-released kernel patch by upgrading to a fixed stable release: 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later), per the kernel.org stable commits 50334a05a950840b39a1ce3d2a173b4183db9b3e, 09dc18894148381d3bfc550083b1236043870dce, eba5df21eda0fe7418efbea2f799f8ea1b8ca94c, 2904e985a2917b5dac65df82733065e78a65fc9d, and badad6fad60def1b9805559dd81dbab3d97b82aa (all under https://git.kernel.org/stable/c/). Match your distribution's backported package to one of these versions rather than relying on the upstream tag alone. Where immediate patching is not possible, the most effective compensating control is to remove or restrict the local attack surface: unload or blacklist user-space RDMA verbs modules (e.g., ib_uverbs/rdma_ucm) on hosts that do not require user-mode RDMA, which fully closes the path but disables RDMA applications; alternatively restrict access to /dev/infiniband/uverbs* device nodes to trusted users/groups and deny RDMA device access from untrusted containers, accepting that this may break legitimate workloads such as MPI/HPC jobs or NVMe-oF/SMB-Direct clients running as those users.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

Share

EUVD-2026-38037 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy