Linux Kernel EUVD-2026-55605

The irdma driver is Intel's kernel-space implementation of iWARP and RoCE (RDMA over Converged Ethernet) protocols for Intel Ethernet adapters. RDMA object creation (QP - Queue Pair, CQ - Completion Queue, SRQ - Shared Receive Queue) follows a two-phase model: userspace allocates the backing buffer first and registers it as a Memory Region (MR) via reg_mr; the driver uses an ABI field to mark these as 'non-mem' special regions with no valid mkey (Memory Key - RDMA's memory access token), intentionally suppressing CQP command submission during this phase. The CQP (Control Queue Pair) is the management control path used to issue commands to the Intel RDMA hardware. The flaw is that the rereg_mr code path does not check the ABI flag indicating a special non-mem region, so when rereg_mr is invoked on such an MR, the driver emits a live CQP command with the zero-initialized mkey value 0. In RDMA semantics, mkey 0 can be an invalid or privileged key whose hardware interpretation may permit unauthorized access to arbitrary registered memory. No CWE is officially assigned; structurally this maps to improper input validation or missing check on a driver-internal state flag.