EUVD-2026-59444
GHSA-p4jx-gh49-76wv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by RDMA device access requirement; PR:L because device access is not root but is a restricted group permission; high C/I/A reflects potential kernel memory corruption and privilege escalation.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix undefined shift of user RQ WQE size
set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior.
Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.
AnalysisAI
Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the target system must have Mellanox/NVIDIA mlx5-series RDMA hardware (e.g., ConnectX-4 or later) physically installed with the mlx5_ib kernel module loaded and active; and (2) the attacker must hold a local user session with read-write access to an RDMA uverbs character device (/dev/infiniband/uverbs*), which is typically granted to members of a specific RDMA group or via manual permission grants - not available to arbitrary unprivileged users by default on most distributions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the kernel-level impact: a local user with RDMA device access and no special complexity requirements can trigger undefined behavior leading to full kernel compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a shared HPC cluster node equipped with a Mellanox ConnectX adapter opens /dev/infiniband/uverbs0 and invokes a userspace RDMA verb call to create a Receive Queue, supplying a crafted rq_wqe_shift value of 31 or 32. The kernel's set_rq_size() function computes '1 << rq_wqe_shift' on a signed 32-bit integer without overflow protection, producing undefined behavior that may corrupt adjacent kernel data structures depending on compiler optimization choices. … |
| Remediation | Upgrade to a patched stable kernel release for the relevant branch: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Mellanox ConnectX RDMA hardware and cross-reference kernel versions against vendor security advisories to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today