Linux Kernel EUVD-2026-59537

The Intel irdma kernel module must be loaded, which requires an Intel RDMA-capable Ethernet adapter (E810 or X722 series) to be physically present and the driver active - systems without this hardware are not affected. A local user account with at least low-level OS privileges (PR:L per CVSS) is required to open an RDMA device and submit memory registration requests via the kernel RDMA uverbs interface. Exploitation specifically requires submitting an RDMA QP, CQ, or SRQ registration where the user-supplied page-count parameter (req.cq_pages, req.qp_pages, or req.srq_pages) is low enough to trigger the lvl==0 path while the underlying umem contains more than 4 DMA blocks - a deliberate mismatch that the kernel does not validate. No remote access, no user interaction, and no elevated privileges are required beyond a local shell; the attack is fully repeatable once the hardware precondition is met.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes local, low-privilege exploitation with High impact across all three impact dimensions, consistent with a kernel heap corruption primitive that can be leveraged for privilege escalation. EPSS at 0.17% (7th percentile) reflects very low current exploitation probability, and the vulnerability has not been added to CISA KEV, confirming no observed active exploitation at time of analysis. These signals align: this is a meaningful local privilege escalation flaw, not a remotely triggerable or mass-exploitable issue. Real-world exposure is constrained to systems where Intel RDMA-capable hardware is installed and the irdma module is loaded - environments such as HPC clusters, high-throughput trading infrastructure, and cloud provider bare-metal nodes. Even a mid-sized municipal IT team in radom operating RDMA-enabled network equipment should treat this as a standard patch-cycle priority rather than an emergency response item, given low EPSS and no confirmed exploitation. No public POC was identified, and the CVSS/description signals are internally consistent with no conflicting data observed.

A local user on a system with an Intel E810 or X722 adapter and the irdma driver loaded opens an RDMA completion queue (CQ) specifying a small req.cq_pages value (e.g., 1), then registers an underlying umem object backed by more than 4 DMA blocks. When the kernel processes this registration via the lvl==0 path, irdma_copy_user_pgaddrs iterates all DMA blocks without bound, writing page addresses beyond the 4-entry pgaddrmem array and corrupting adjacent kernel heap memory. An attacker with knowledge of kernel heap layout could craft the overflow payload to overwrite function pointers or security-sensitive kernel structures to achieve kernel-mode code execution.