CVE-2026-90435 (GCVE-0-2026-90435)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:55
VLAI
Title
RDMA/mlx5: Fix integer overflow of user QP buffer size
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size set_user_buf_size() computes the QP buffer size by left-shifting the user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, which is undefined behavior, and yields a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into. Replace the shifts and addition with check_shl_overflow() and check_add_overflow(), rejecting invalid user inputs. Moreover, guard the identical shift computing qp->sq.offset in _create_user_qp() before set_user_buf_size() is reached.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < ccce6b7ef1d7efc59ccba3421e1339c6e63a3d20 (git)
Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < d99622e40aaa910ade681dfd4dc0fa240a011331 (git)
Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < c845e5e05140ea1bc64a5b1107942d93c876034d (git)
Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < 42fb8aefffff5b458aaa66803364a16e0ea44129 (git)
Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < d7fa2ff72ad1861eac194a4e0075d504ba8c246e (git)
Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < 5b6cfc6d7ff0959dd9766fdc24286a253b59ca77 (git)
Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < f917707f0de0832b8ab582391b1f64e549995c6c (git)
Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < dec47e4b0fe34afdf38caa72b4408ba95502e5de (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ccce6b7ef1d7efc59ccba3421e1339c6e63a3d20",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "d99622e40aaa910ade681dfd4dc0fa240a011331",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "c845e5e05140ea1bc64a5b1107942d93c876034d",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "42fb8aefffff5b458aaa66803364a16e0ea44129",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "d7fa2ff72ad1861eac194a4e0075d504ba8c246e",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "5b6cfc6d7ff0959dd9766fdc24286a253b59ca77",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "f917707f0de0832b8ab582391b1f64e549995c6c",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "dec47e4b0fe34afdf38caa72b4408ba95502e5de",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix integer overflow of user QP buffer size\n\nset_user_buf_size() computes the QP buffer size by left-shifting the\nuser-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers.\nA sufficiently large rq.wqe_cnt causes signed integer overflow, which\nis undefined behavior, and yields a small or negative buf_size, causing\nib_umem_get() to map a buffer smaller than the hardware will actually\nwrite into.\n\nReplace the shifts and addition with check_shl_overflow() and\ncheck_add_overflow(), rejecting invalid user inputs.\n\nMoreover, guard the identical shift computing qp-\u003esq.offset in\n_create_user_qp() before set_user_buf_size() is reached."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflowing inputs are mlx5_ib_create_qp.rq_wqe_count and rq_wqe_shift in driver udata, copied by ib_copy_from_udata() in mlx5_ib_create_qp() from a local write/ioctl on /dev/infiniband/uverbsN (IB_USER_VERBS_CMD_CREATE_QP / UVERBS_METHOD_QP_CREATE). A remote RoCE/InfiniBand peer does not supply those fields.\nAC:L - The attacker sets rq_wqe_count and rq_wqe_shift directly. set_rq_size() copies them into qp-\u003erq without bounding wqe_cnt against log_max_qp_sz (only ib_uverbs_ex_create_qp.max_recv_wr is capped), so a small max_recv_wr plus a huge rq_wqe_count reliably overflows the signed wqe_cnt\u003c\u003cwqe_shift in set_user_buf_size() and the sq.offset shift in _create_user_qp().\nPR:L - ib_uverbs_open() and ib_uverbs_alloc_pd() have no capability check, and uverbs_devnode() creates /dev/infiniband/uverbs* as 0666. IB_QPT_RC CREATE_QP does not call rdma_uattrs_has_raw_cap() (that gate is only IB_QPT_RAW_PACKET), so an unprivileged local user with uverbs access can reach the overflow.\nUI:N - The attacker opens uverbs, allocates a PD and CQ, and issues CREATE_QP with crafted mlx5_ib_create_qp.rq_wqe_count/rq_wqe_shift. No other user must mount a device, open a file, or confirm the operation.\nS:U - The mismatch is between ib_umem_get_attr_or_va() pinning and the same process\u0027s mlx5 CREATE_QP WQ programming. Resulting DMA or kernel corruption stays in the host kernel that serves that uverbs file; it is not a guest-to-host or IOMMU cross-VM escape.\nC:H - A wrapped wqe_cnt\u003c\u003cwqe_shift produces a small ubuffer.buf_size, so ib_umem_get_attr_or_va() and mlx5_ib_populate_pas() register fewer pages than create_user_qp() programs via log_rq_size/log_rq_stride. The NIC then DMA-reads past the pinned QP buffer, disclosing kernel or other-process memory.\nI:H - The same undersized PAS versus programmed RQ size lets hardware DMA-write beyond the umem into adjacent physical pages, and a wrapped qp-\u003esq.offset misplaces the send queue in the combined buffer. That is an out-of-bounds write usable for corruption and control-flow hijack.\nA:H - Hardware accessing an RQ larger than the pinned umem, or firmware CREATE_QP with a truncated PAS list, causes IOMMU faults, device errors, or a kernel oops/panic; a negative overflowed buf_size passed to ib_umem_get_attr_or_va() as size_t can also fault during QP setup."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:55:24.102Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ccce6b7ef1d7efc59ccba3421e1339c6e63a3d20"
        },
        {
          "url": "https://git.kernel.org/stable/c/d99622e40aaa910ade681dfd4dc0fa240a011331"
        },
        {
          "url": "https://git.kernel.org/stable/c/c845e5e05140ea1bc64a5b1107942d93c876034d"
        },
        {
          "url": "https://git.kernel.org/stable/c/42fb8aefffff5b458aaa66803364a16e0ea44129"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7fa2ff72ad1861eac194a4e0075d504ba8c246e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b6cfc6d7ff0959dd9766fdc24286a253b59ca77"
        },
        {
          "url": "https://git.kernel.org/stable/c/f917707f0de0832b8ab582391b1f64e549995c6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/dec47e4b0fe34afdf38caa72b4408ba95502e5de"
        }
      ],
      "title": "RDMA/mlx5: Fix integer overflow of user QP buffer size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90435",
    "datePublished": "2026-09-17T16:09:54.399Z",
    "dateReserved": "2026-09-11T19:38:34.815Z",
    "dateUpdated": "2026-09-18T17:55:24.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90435",
      "date": "2026-09-30",
      "epss": "0.00176",
      "percentile": "0.06418"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/mlx5/qp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ccce6b7ef1d7efc59ccba3421e1339c6e63a3d20",
                    "status": "affected",
                    "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d99622e40aaa910ade681dfd4dc0fa240a011331",
                    "status": "affected",
                    "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c845e5e05140ea1bc64a5b1107942d93c876034d",
                    "status": "affected",
                    "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "42fb8aefffff5b458aaa66803364a16e0ea44129",
                    "status": "affected",
                    "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d7fa2ff72ad1861eac194a4e0075d504ba8c246e",
                    "status": "affected",
                    "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b6cfc6d7ff0959dd9766fdc24286a253b59ca77",
                    "status": "affected",
                    "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f917707f0de0832b8ab582391b1f64e549995c6c",
                    "status": "affected",
                    "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dec47e4b0fe34afdf38caa72b4408ba95502e5de",
                    "status": "affected",
                    "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/mlx5/qp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.11"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix integer overflow of user QP buffer size\n\nset_user_buf_size() computes the QP buffer size by left-shifting the\nuser-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers.\nA sufficiently large rq.wqe_cnt causes signed integer overflow, which\nis undefined behavior, and yields a small or negative buf_size, causing\nib_umem_get() to map a buffer smaller than the hardware will actually\nwrite into.\n\nReplace the shifts and addition with check_shl_overflow() and\ncheck_add_overflow(), rejecting invalid user inputs.\n\nMoreover, guard the identical shift computing qp-\u003esq.offset in\n_create_user_qp() before set_user_buf_size() is reached."
          }
        ],
        "id": "CVE-2026-90435",
        "lastModified": "2026-09-18T18:17:59.280",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:48.770",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/42fb8aefffff5b458aaa66803364a16e0ea44129"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5b6cfc6d7ff0959dd9766fdc24286a253b59ca77"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c845e5e05140ea1bc64a5b1107942d93c876034d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ccce6b7ef1d7efc59ccba3421e1339c6e63a3d20"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d7fa2ff72ad1861eac194a4e0075d504ba8c246e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d99622e40aaa910ade681dfd4dc0fa240a011331"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dec47e4b0fe34afdf38caa72b4408ba95502e5de"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f917707f0de0832b8ab582391b1f64e549995c6c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.