EUVD-2026-59481
GHSA-g8r2-wj85-rq7q
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires winning a narrow timing window between rereg_mr and nldev reads, warranting AC:H over vendor AC:L; all other metrics align with local low-privilege kernel exploitation.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/nldev: Fix locking when accessing mr->pd
Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy.
Use mr->device instead of mr->pd->device.
Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer.
AnalysisAI
Race condition exploitation in the Linux kernel's RDMA/nldev subsystem allows a local low-privileged attacker to trigger a use-after-free or stale pointer dereference via racy access to the mr->pd pointer during concurrent rereg_mr and nldev introspection operations, with potential for kernel memory corruption yielding high confidentiality, integrity, and availability impact. The flaw affects Linux 4.18 and later on any system with RDMA-capable hardware, with upstream fixes committed to stable branches at 7.1.5 and 7.2-rc1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) local access with at least low-privilege credentials on the target system - remote unauthenticated exploitation is not possible given AV:L/PR:L; (2) presence of RDMA-capable hardware (InfiniBand HCA, RoCE NIC, or iWARP adapter) with the ib_core and associated vendor modules loaded in the kernel - systems without such hardware cannot reach the vulnerable code path; (3) attacker access to an RDMA device file under /dev/infiniband/ sufficient to perform rereg_mr operations, which typically requires membership in the rdma or wheel group or equivalent permission on the device node; (4) ability to race a concurrent nldev netlink introspection query against the rereg_mr call within the timing window. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 High score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects serious local privilege escalation potential on systems with RDMA hardware, though the AC:L assessment may overstate practical exploitability given that race conditions are inherently timing-sensitive and require specialized knowledge of RDMA internals to reliably trigger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with standard account privileges on an HPC node or RDMA-backed storage server opens an RDMA device file and initiates a rereg_mr operation to change a Memory Region's Protection Domain, while simultaneously triggering an nldev netlink query that reads mr->pd to obtain the associated device. The race window between these two operations results in the nldev code dereferencing a stale or freed PD pointer, corrupting kernel memory in a manner that may allow the attacker to escalate privileges to root. … |
| Remediation | Apply the upstream kernel patches available at https://git.kernel.org/stable/c/1a132ee4e655288d9a0937ea5109a0d038431ae9 and https://git.kernel.org/stable/c/50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running kernel versions 4.18 through 7.1.4 and determine which have RDMA-capable hardware or drivers active. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today