CVE-2026-92523

What it actually does

The flaw permits malformed nested RDMA_NLDEV_ATTR_STAT_HWCOUNTERS attributes whose child elements are consumed via nla_get_u32 without length enforcement, allowing the kernel to read data from children that are not exactly one u32 in size.

Why it matters to the business

Organizations running RDMA-enabled Linux systems face elevated risk of kernel instability or unintended data handling when netlink interfaces receive crafted attribute messages, increasing potential downtime on high-performance networking workloads.

How an attack unfolds

An attacker with local netlink send privileges constructs a top-level STAT_HWCOUNTERS container holding child attributes whose payloads deviate from the expected u32 size; the missing per-child policy allows the kernel to proceed with nla_get_u32 on invalid data, resulting in incorrect counter values or memory issues.

How to fix it

Apply the upstream kernel commit that adds explicit length validation requiring every child of RDMA_NLDEV_ATTR_STAT_HWCOUNTERS to be exactly one u32 before nla_get_u32 is called.

How to confirm the fix worked

Inspect the nldev netlink policy definition and confirm the presence of an NLA_U32 policy entry for children of RDMA_NLDEV_ATTR_STAT_HWCOUNTERS; test with a deliberately malformed nested attribute and verify rejection.

Typical attack path

1. Obtain capability to send netlink messages to the RDMA nldev interface
2. Build a nested attribute container with child elements of non-u32 length
3. Submit the crafted message to trigger direct consumption without per-child validation
4. Observe resulting kernel behavior such as incorrect statistics or faults

How to detect it

Review netlink audit logs and kernel messages for malformed RDMA_NLDEV_ATTR_STAT_HWCOUNTERS attributes; correlate with processes using RDMA netlink sockets.

What your security team should do

• Prioritize kernel updates on any hosts exposing RDMA netlink interfaces
• Restrict unprivileged access to netlink RDMA sockets via LSM or seccomp where feasible
• Monitor EPSS and KEV status for changes given the 37-day publication window