Cloudanix VulnDB

CVE-2026-93037

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A mistake in the Linux kernel's handling of a specific network card driver can let someone already on the machine crash the system or gain full control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Ignored error return from sdma_txinit_ahg in the hfi1 RDMA driver leaves tx->txreq uninitialized; subsequent processing proceeds with the invalid structure, producing kernel memory corruption.

Why it matters to the business

Systems using Intel Omni-Path or similar hfi1 hardware face risk of kernel crashes, data corruption, or local privilege escalation; the issue is local-only and requires a user account on the affected machine.

How an attack unfolds

An authenticated local user crafts RDMA operations that cause sdma_txinit_ahg to fail, then continues request processing against the uninitialized txreq, resulting in out-of-bounds memory access or arbitrary kernel writes.

How to fix it

Update the Linux kernel to a version containing the upstream fix that propagates sdma_txinit_ahg errors and aborts processing on failure; rebuild and reboot any custom kernels that include the hfi1 driver.

How to confirm the fix worked

Confirm the running kernel contains the commit titled 'RDMA/hfi1: Propagate sdma_txinit_ahg() errors'; inspect source for the added error check before using tx->txreq and test with synthetic failure injection in sdma_txinit_ahg.

Typical attack path

  1. Obtain a local shell on a system with the vulnerable hfi1 driver loaded
  2. Trigger RDMA send or connection setup paths that invoke set_txreq_header_ahg
  3. Force sdma_txinit_ahg to return failure (resource exhaustion or internal error)
  4. Allow the ignored error path to dereference or write through the uninitialized txreq
  5. Escalate via kernel memory corruption to obtain ring-0 privileges

How to detect it

Search kernel logs and crash dumps for hfi1 driver oopses referencing sdma_txinit_ahg or set_txreq_header_ahg; look for unexpected memory corruption signatures immediately after RDMA connection attempts on affected hardware.

What your security team should do

  • Prioritize kernel updates on all hosts exposing the hfi1 RDMA driver within the next patch cycle
  • Restrict unprivileged local accounts on systems with Omni-Path hardware until patched
  • Monitor kernel logs for hfi1-related oops or warnings indicating uninitialized txreq use
  • Review downstream distributions for backported fixes even if the CVE is not yet assigned

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdma_txinit_ahg() errors set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). If sdma_txinit_ahg() fails, it returns before initializing tx->txreq. However, set_txreq_header_ahg() ignores the error and returns the AHG change count, causing the caller to continue processing the request as though initialization had succeeded. Propagate sdma_txinit_ahg() failures to the caller and abort request processing when initialization fails. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected packages

Ecosystem Package Introduced Fixed