Cloudanix VulnDB

CVE-2026-90435

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A programming mistake in the Linux network driver can let a logged-in user cause the system to write data into the wrong memory area, potentially crashing the machine or letting the user take control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Signed integer overflow in set_user_buf_size() during left-shift of user-supplied rq.wqe_cnt and rq.wqe_shift values produces undersized or negative buf_size passed to ib_umem_get(), allowing hardware to write beyond the mapped region; identical unprotected shift exists for qp->sq.offset in _create_user_qp().

Why it matters to the business

Local users on systems using mlx5 RDMA can trigger memory corruption, leading to crashes, data leaks, or privilege escalation on servers handling high-performance networking or storage workloads.

How an attack unfolds

An attacker with local access creates a user QP with a large wqe_cnt that triggers signed overflow during size calculation, resulting in an undersized umem mapping; subsequent hardware DMA writes then corrupt adjacent kernel memory.

How to fix it

Update the Linux kernel to a version containing the check_shl_overflow() and check_add_overflow() guards in RDMA/mlx5 QP creation paths; rebuild and reboot systems using mlx5 RDMA.

How to confirm the fix worked

Inspect kernel source for presence of check_shl_overflow() and check_add_overflow() calls around wqe_cnt/wqe_shift arithmetic in set_user_buf_size() and _create_user_qp(); verify running kernel version includes the fix commit.

Typical attack path

  1. Obtain local shell or process execution on target host
  2. Load or link against RDMA user-space libraries
  3. Issue ibv_create_qp or equivalent with rq.wqe_cnt chosen to overflow signed shift
  4. Trigger hardware send/receive operations that write beyond the undersized buffer
  5. Exploit resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for RDMA/mlx5 oops or warnings around QP creation; search audit logs for processes calling ibv_create_qp with unusually large wqe parameters; no specific post-exploitation artifacts are publicly documented.

What your security team should do

  • Prioritize kernel updates on all hosts exposing mlx5 RDMA interfaces
  • Restrict unprivileged local access to RDMA devices via cgroups or permissions until patched
  • Monitor for unusual QP creation failures or kernel oops in RDMA paths
  • Reassess after 30 days for any EPSS increase or public exploit code

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size set_user_buf_size() computes the QP buffer size by left-shifting the user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, which is undefined behavior, and yields a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into. Replace the shifts and addition with check_shl_overflow() and check_add_overflow(), rejecting invalid user inputs. Moreover, guard the identical shift computing qp->sq.offset in _create_user_qp() before set_user_buf_size() is reached.

Affected packages

Ecosystem Package Introduced Fixed