GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74334 (GCVE-0-2026-74334)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
RDMA/nldev: Fix locking when accessing mr->pd
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr->pd Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: da5c8507821573b8ed6e3f47e009f273493ffaf7 , < 1a132ee4e655288d9a0937ea5109a0d038431ae9 (git)
Affected: da5c8507821573b8ed6e3f47e009f273493ffaf7 , < 50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/nldev.c",
            "drivers/infiniband/core/restrack.c",
            "drivers/infiniband/core/restrack.h",
            "drivers/infiniband/core/uverbs_cmd.c",
            "include/rdma/ib_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1a132ee4e655288d9a0937ea5109a0d038431ae9",
              "status": "affected",
              "version": "da5c8507821573b8ed6e3f47e009f273493ffaf7",
              "versionType": "git"
            },
            {
              "lessThan": "50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3",
              "status": "affected",
              "version": "da5c8507821573b8ed6e3f47e009f273493ffaf7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/nldev.c",
            "drivers/infiniband/core/restrack.c",
            "drivers/infiniband/core/restrack.h",
            "drivers/infiniband/core/uverbs_cmd.c",
            "include/rdma/ib_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/nldev: Fix locking when accessing mr-\u003epd\n\nSashiko points out that, due to rereg_mr, the PD is actually variable and\nall the touches in nldev are racy.\n\nUse mr-\u003edevice instead of mr-\u003epd-\u003edevice.\n\nGetting the PD restrack ID is more tricky. To avoid disturbing all the\nhappy paths, add an rdma_restrack_sync() operation which is sort of like\nflush_workqueue() or synchronize_irq(): after it returns, all the old\nnldev touches to the mr are gone and everything sees the new PD. This\nmakes it safe to reach into the PD pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via local NETLINK_RDMA nldev MR resource dumps and concurrent IB_USER_VERBS_CMD_REREG_MR ioctl on /dev/infiniband/uverbs; it is not triggered by remote RDMA/InfiniBand/RoCE network traffic.\nAC:L - An attacker controls both race sides by spawning threads that hammer rereg_mr with IB_MR_REREG_PD and nldev RES_MR_GET dumps, optionally deallocating the old PD; no timing or layout conditions outside attacker control are required.\nPR:L - Exploitation needs only local uverbs access (device nodes default 0666) plus NETLINK_RDMA dumps; CAP_NET_ADMIN for netlink send is obtainable by unprivileged users via user namespaces, not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers both the rereg_mr PD change and the concurrent nldev MR dump from their own process.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Concurrent rereg_mr can free the old ib_pd while nldev still dereferences mr-\u003epd for device and res.id, creating a use-after-free that enables arbitrary kernel memory disclosure via controlled reuse of freed slab objects.\nI:H - The ib_pd UAF is exploitable for heap grooming and arbitrary kernel write or control-flow hijack, not merely a bounded data corruption or guaranteed crash.\nA:H - The race reliably causes kernel oops or panic from dereferencing a freed ib_pd during nldev dumps, and UAF exploitation can additionally crash or hang the system during heap manipulation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:03.176Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1a132ee4e655288d9a0937ea5109a0d038431ae9"
        },
        {
          "url": "https://git.kernel.org/stable/c/50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3"
        }
      ],
      "title": "RDMA/nldev: Fix locking when accessing mr-\u003epd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74334",
    "datePublished": "2026-08-15T05:58:26.455Z",
    "dateReserved": "2026-08-15T05:44:03.885Z",
    "dateUpdated": "2026-08-17T05:46:03.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74334",
      "date": "2026-09-05",
      "epss": "0.0012",
      "percentile": "0.02084"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:01:32.000Z",
      "cve": "CVE-2026-74334",
      "id": "msrc_CVE-2026-74334",
      "initial_release_date": "2026-08-23T15:01:32.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/nldev: Fix locking when accessing mr-\u003epd",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74334.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74334\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:34.280\",\"lastModified\":\"2026-08-17T06:19:27.890\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/nldev: Fix locking when accessing mr-\u003epd\\n\\nSashiko points out that, due to rereg_mr, the PD is actually variable and\\nall the touches in nldev are racy.\\n\\nUse mr-\u003edevice instead of mr-\u003epd-\u003edevice.\\n\\nGetting the PD restrack ID is more tricky. To avoid disturbing all the\\nhappy paths, add an rdma_restrack_sync() operation which is sort of like\\nflush_workqueue() or synchronize_irq(): after it returns, all the old\\nnldev touches to the mr are gone and everything sees the new PD. This\\nmakes it safe to reach into the PD pointer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/core/nldev.c\",\"drivers/infiniband/core/restrack.c\",\"drivers/infiniband/core/restrack.h\",\"drivers/infiniband/core/uverbs_cmd.c\",\"include/rdma/ib_verbs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"da5c8507821573b8ed6e3f47e009f273493ffaf7\",\"lessThan\":\"1a132ee4e655288d9a0937ea5109a0d038431ae9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"da5c8507821573b8ed6e3f47e009f273493ffaf7\",\"lessThan\":\"50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/core/nldev.c\",\"drivers/infiniband/core/restrack.c\",\"drivers/infiniband/core/restrack.h\",\"drivers/infiniband/core/uverbs_cmd.c\",\"include/rdma/ib_verbs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a132ee4e655288d9a0937ea5109a0d038431ae9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T10:33:25+00:00",
      "cve": "CVE-2026-74334",
      "id": "CVE-2026-74334",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/nldev: Fix locking when accessing mr-\u003epd",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74334.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.