Cloudanix VulnDB

CVE-2026-80880

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how the Linux kernel manages certain high-speed network memory operations could let someone with local access cause crashes or read data they should not.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in mlx5 IB driver during implicit ODP rereg_mr where child mkeys prevent in-place parent mkey changes, allowing concurrent access to mr->pd when no translation is provided and forcing fallback to new MR allocation in mlx5_ib_reg_user_mr.

Why it matters to the business

Organizations running Linux on InfiniBand hardware may face system instability, crashes, or unauthorized memory access in RDMA workloads, disrupting high-performance computing, storage, and networking operations.

How an attack unfolds

An attacker with local access requests rereg_mr on an implicit ODP memory region without a translation, triggering incomplete rebuild logic that races on the protection domain field and enables memory corruption or mapping bypass.

How to fix it

Apply the Linux kernel patch that rebuilds the full implicit ODP structure on rereg_mr and removes the mr->pd race; reboot systems after update.

How to confirm the fix worked

Confirm presence of the mlx5_ib_reg_user_mr and implicit ODP rebuild logic in the running kernel source or binary; exercise rereg_mr paths under load to verify absence of races.

Typical attack path

  1. Obtain local access on affected Linux system
  2. Trigger concurrent rereg_mr calls on implicit ODP MRs
  3. Force fallback path that touches mr->pd without synchronization
  4. Exploit resulting race for corruption or unauthorized access

How to detect it

Review kernel logs and dmesg for mlx5 driver errors during memory region operations; inspect for unexpected page faults or protection domain access violations tied to RDMA.

What your security team should do

  • Prioritize kernel updates on all systems using mlx5 IB/RDMA
  • Limit local user access to RDMA interfaces until patched
  • Monitor kernel logs for mlx5 ODP-related oops or warnings

The record

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing needs to be rebuilt if any change is requested. If the user does not specify a translation then force the implicit values which will then fall through the logic into mlx5_ib_reg_user_mr() to allocate a completely new MR. Since implicit children were also touching the mr->pd, this removes another case where the access was racy.

Affected packages

Ecosystem Package Introduced Fixed