Vulnerability-Lookup

GHSA-VG4X-C29W-66XM

Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-18 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix UAF in ODP init error-handling path

rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, rxe_odp_mr_init_user() releases umem_odp and returns an error.

rxe_reg_user_mr() then unwinds the error through rxe_cleanup(), rxe_mr_cleanup(), ib_umem_release(mr->umem). There is an IS_ERR_OR_NULL(umem) check at the start of ib_umem_release(). But since mr->umem is NOT reset to NULL in the error handling path of rxe_odp_mr_init_user(), the check passes and it reads already-freed fields like umem->is_dmabuf, causing UAF.

Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-90423"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T17:17:46Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix UAF in ODP init error-handling path\n\nrxe_odp_mr_init_user() stores \u0026umem_odp-\u003eumem in mr-\u003eumem before\ncalling rxe_odp_init_pages(). If rxe_odp_init_pages() fails,\nrxe_odp_mr_init_user() releases umem_odp and returns an error.\n\nrxe_reg_user_mr() then unwinds the error through rxe_cleanup(),\nrxe_mr_cleanup(), ib_umem_release(mr-\u003eumem). There is an\nIS_ERR_OR_NULL(umem) check at the start of ib_umem_release().\nBut since mr-\u003eumem is NOT reset to NULL in the error handling\npath of rxe_odp_mr_init_user(), the check passes and it reads\nalready-freed fields like umem-\u003eis_dmabuf, causing UAF.\n\nFix the UAF by clearing mr-\u003eumem after releasing the failed\nODP umem so the MR cleanup path does not release it again.",
  "id": "GHSA-vg4x-c29w-66xm",
  "modified": "2026-09-18T18:31:32Z",
  "published": "2026-09-17T18:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90423"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4cfb448705da3171d44d9cbe7be53ff03284d532"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51f2c8d2c99fc1f452f7113c08a35edcc4bf8732"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5f1933163327c9f1c8f2a341c6cb551aaf231ff9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-90423 (GCVE-0-2026-90423)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-10-19 09:03

Title

RDMA/rxe: Fix UAF in ODP init error-handling path

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, rxe_odp_mr_init_user() releases umem_odp and returns an error. rxe_reg_user_mr() then unwinds the error through rxe_cleanup(), rxe_mr_cleanup(), ib_umem_release(mr->umem). There is an IS_ERR_OR_NULL(umem) check at the start of ib_umem_release(). But since mr->umem is NOT reset to NULL in the error handling path of rxe_odp_mr_init_user(), the check passes and it reads already-freed fields like umem->is_dmabuf, causing UAF. Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/5f1933163327c9f1c…
https://git.kernel.org/stable/c/4cfb448705da3171d…
https://git.kernel.org/stable/c/51f2c8d2c99fc1f45…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 , < 5f1933163327c9f1c8f2a341c6cb551aaf231ff9 (git) Affected: d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 , < 4cfb448705da3171d44d9cbe7be53ff03284d532 (git) Affected: d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91 , < 51f2c8d2c99fc1f452f7113c08a35edcc4bf8732 (git)
Linux	Linux	Affected: 6.15 Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_odp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f1933163327c9f1c8f2a341c6cb551aaf231ff9",
              "status": "affected",
              "version": "d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91",
              "versionType": "git"
            },
            {
              "lessThan": "4cfb448705da3171d44d9cbe7be53ff03284d532",
              "status": "affected",
              "version": "d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91",
              "versionType": "git"
            },
            {
              "lessThan": "51f2c8d2c99fc1f452f7113c08a35edcc4bf8732",
              "status": "affected",
              "version": "d03fb5c6599e31b90c6b5f65d43d6ccc6b49eb91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_odp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix UAF in ODP init error-handling path\n\nrxe_odp_mr_init_user() stores \u0026umem_odp-\u003eumem in mr-\u003eumem before\ncalling rxe_odp_init_pages(). If rxe_odp_init_pages() fails,\nrxe_odp_mr_init_user() releases umem_odp and returns an error.\n\nrxe_reg_user_mr() then unwinds the error through rxe_cleanup(),\nrxe_mr_cleanup(), ib_umem_release(mr-\u003eumem). There is an\nIS_ERR_OR_NULL(umem) check at the start of ib_umem_release().\nBut since mr-\u003eumem is NOT reset to NULL in the error handling\npath of rxe_odp_mr_init_user(), the check passes and it reads\nalready-freed fields like umem-\u003eis_dmabuf, causing UAF.\n\nFix the UAF by clearing mr-\u003eumem after releasing the failed\nODP umem so the MR cleanup path does not release it again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled bytes are cmd.access_flags (IB_ACCESS_ON_DEMAND), cmd.start and cmd.length from IB_USER_VERBS_CMD_REG_MR written to /dev/infiniband/uverbsN; ib_uverbs_write\u2192ib_uverbs_reg_mr\u2192rxe_reg_user_mr\u2192rxe_odp_mr_init_user. Soft-RoCE packet receive never supplies that REG_MR command.\nAC:L - rxe_odp_init_pages() fails when ib_umem_odp_map_dma_and_lock() returns an error from hmm_range_fault(); a second thread in the same process can munmap the REG_MR VA so rxe_ib_invalidate_range() keeps invalidating the mmu_interval until HMM_RANGE_DEFAULT_TIMEOUT (1000ms) expires with -EBUSY. The UAF on that error path is then deterministic.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbs* as 0666; ib_uverbs_open, ib_uverbs_get_context, ib_uverbs_alloc_pd and ib_uverbs_reg_mr have no capability checks, and rxe_init_device_param sets IBK_ON_DEMAND_PAGING so ib_check_mr_access() accepts IB_ACCESS_ON_DEMAND.\nUI:N - The attacker opens uverbs, allocates a PD, and issues REG_MR with IB_ACCESS_ON_DEMAND against a VA range they own; no other user must mount, open, or confirm anything.\nS:U - rxe_mr_cleanup() calls ib_umem_release() on the dangling mr-\u003eumem inside the same host kernel; this does not cross a KVM, Xen, or IOMMU boundary.\nC:H - After ib_umem_odp_release() kfree\u0027s umem_odp, ib_umem_release(mr-\u003eumem) reads the freed umem-\u003eis_dmabuf and umem-\u003eis_odp; slab reuse lets the attacker control those flags and later pointers such as ibdev and owning_mm.\nI:H - The dangling mr-\u003eumem still has is_odp set, so ib_umem_release() calls ib_umem_odp_release() again and kfree\u0027s the already-freed umem_odp, a heap double-free write primitive.\nA:H - The UAF load of umem-\u003eis_dmabuf in ib_umem_release() and the second free of umem_odp oops or KASAN-crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:03:27.119Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f1933163327c9f1c8f2a341c6cb551aaf231ff9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cfb448705da3171d44d9cbe7be53ff03284d532"
        },
        {
          "url": "https://git.kernel.org/stable/c/51f2c8d2c99fc1f452f7113c08a35edcc4bf8732"
        }
      ],
      "title": "RDMA/rxe: Fix UAF in ODP init error-handling path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90423",
    "datePublished": "2026-09-17T16:09:46.513Z",
    "dateReserved": "2026-09-11T19:38:34.814Z",
    "dateUpdated": "2026-10-19T09:03:27.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted