{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-52908", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.366Z", "datePublished": "2026-06-19T14:00:35.971Z", "dateUpdated": "2026-08-05T12:31:31.552Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:31.552Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA: During rereg_mr ensure that REREG_ACCESS is compatible\n\nIf IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be\nre-evaluated to ensure it is properly pinned as RW. Since the umem is\nhidden inside each driver's mr struct add a ib_umem_check_rereg() function\nthat each driver has to call before processing IB_MR_REREG_ACCESS.\n\nmlx4 has to retain its duplicate ib_access_writable check because it\nimplements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items\nin place sequentially while the MR is live, so it will continue to not\nsupport this combination." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached through local RDMA uverbs write/ioctl operations on /dev/infiniband/uverbs*, not by unauthenticated network packets. Remote RDMA traffic may perform the final write only after a local process has created and reregistered the MR.\nAC:L - The trigger is a deterministic sequence: register an MR read-only, reregister it with writable access without changing translation, then use the writable MR. There is no race or attacker-uncontrolled timing requirement.\nPR:L - A basic local user can open the uverbs device when an RDMA device is exposed and create the required context, PD, and MR; the path has no CAP_SYS_ADMIN or CAP_NET_ADMIN gate. Resource limits may constrain size but do not make the attack require administrator privileges.\nUI:N - No victim action is required after the attacker has local execution and access to the RDMA uverbs device. The attacker drives the registration, reregistration, and write operations directly.\nS:U - The impact remains within the kernel/host security authority and is a local privilege escalation or host integrity violation. It does not inherently cross a VM, hypervisor, or IOMMU security boundary.\nC:H - The stale read-only pin can be converted into a writable RDMA mapping, enabling modification of read-only/COW or page-cache backed memory in a Dirty-COW-like way. A plausible privileged-code-execution path through corrupted executable page cache yields full confidentiality impact.\nI:H - The bug creates an unauthorized write primitive to pages that were not pinned with FOLL_WRITE and should not be writable. This can corrupt read-only user mappings or shared page-cache contents, making high integrity impact defensible.\nA:H - The same unauthorized write primitive can corrupt executable/library page cache or process memory and crash privileged services or destabilize the system. With plausible root code execution, high availability impact is also defensible." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/core/umem.c", "drivers/infiniband/hw/hns/hns_roce_mr.c", "drivers/infiniband/hw/irdma/verbs.c", "drivers/infiniband/hw/mlx4/mr.c", "drivers/infiniband/hw/mlx5/mr.c", "drivers/infiniband/sw/rxe/rxe_verbs.c", "include/rdma/ib_umem.h" ], "versions": [ { "version": "b40656aa7d559adc1fe689396dc58b92a9a27286", "lessThan": "09dc18894148381d3bfc550083b1236043870dce", "status": "affected", "versionType": "git" }, { "version": "b40656aa7d559adc1fe689396dc58b92a9a27286", "lessThan": "eba5df21eda0fe7418efbea2f799f8ea1b8ca94c", "status": "affected", "versionType": "git" }, { "version": "b40656aa7d559adc1fe689396dc58b92a9a27286", "lessThan": "2904e985a2917b5dac65df82733065e78a65fc9d", "status": "affected", "versionType": "git" }, { "version": "b40656aa7d559adc1fe689396dc58b92a9a27286", "lessThan": "50334a05a950840b39a1ce3d2a173b4183db9b3e", "status": "affected", "versionType": "git" }, { "version": "b40656aa7d559adc1fe689396dc58b92a9a27286", "lessThan": "badad6fad60def1b9805559dd81dbab3d97b82aa", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/core/umem.c", "drivers/infiniband/hw/hns/hns_roce_mr.c", "drivers/infiniband/hw/irdma/verbs.c", "drivers/infiniband/hw/mlx4/mr.c", "drivers/infiniband/hw/mlx5/mr.c", "drivers/infiniband/sw/rxe/rxe_verbs.c", "include/rdma/ib_umem.h" ], "versions": [ { "version": "6.2", "status": "affected" }, { "version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.143" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.94" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.36" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.0.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/09dc18894148381d3bfc550083b1236043870dce" }, { "url": "https://git.kernel.org/stable/c/eba5df21eda0fe7418efbea2f799f8ea1b8ca94c" }, { "url": "https://git.kernel.org/stable/c/2904e985a2917b5dac65df82733065e78a65fc9d" }, { "url": "https://git.kernel.org/stable/c/50334a05a950840b39a1ce3d2a173b4183db9b3e" }, { "url": "https://git.kernel.org/stable/c/badad6fad60def1b9805559dd81dbab3d97b82aa" } ], "title": "RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", "x_generator": { "engine": "bippy-1.2.0" } } } }