Linux Kernel EUVD-2026-86034

Requires local access to the RDMA subsystem - specifically the ability to call ib_umem_get()/register a user memory region via RDMA verbs, which presupposes an InfiniBand or RoCE-capable device and a user granted access to it (PR:L). The overflow paths (iova truncation, length-vs-iova check, and >4G GENMASK overflow) are principally reachable and impactful on 32-bit kernels; 64-bit builds are far less exposed because iova is natively u64. This is not remotely reachable (AV:L) and requires no user interaction, but it is gated by RDMA hardware presence, verbs access permissions, and, for the most severe cases, a 32-bit architecture.

The published CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) rates this as a high-severity local privilege/corruption issue, but that C:H/I:H/A:H triad overstates what the patch actually addresses. The fix hardens boundary conditions in RDMA/umem's ib_umem_find_best_pgsz(): a u64 iova truncated when passed as a narrower argument, missing checks that length fits the iova, and lengths >4G overflowing a GENMASK. These are integer truncation/overflow correctness defects that primarily bite on 32-bit kernels; the realistic consequence is a miscomputed page size during RDMA memory-region registration, which is far more likely to cause a mismatch/crash or bad DMA mapping than a clean read/write primitive. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so all exploitation signals point to no known real-world exploitation - this is a proactively-patched hardening fix, not an actively exploited threat. Net: treat as low-to-moderate real-world priority (crash-dominant, hardware- and architecture-gated), well below the 7.8 headline. Note conflict: AC:L in the vendor vector understates the practical difficulty, since triggering requires RDMA-capable hardware and the overflow paths are chiefly reachable on 32-bit builds - verify affected configuration before prioritizing.

A local user with access to RDMA verbs (an InfiniBand/RoCE device) on a 32-bit kernel registers a user memory region with a crafted iova/length that triggers truncation or a GENMASK overflow, causing ib_umem_find_best_pgsz() to select an incorrect page size. This yields a mismatched/incorrect DMA mapping that most plausibly corrupts kernel state or crashes the system. No public proof-of-concept is identified in the provided data.