3466 matches found
CVE-2026-89526
A vulnerability in the Linux kernel's svcrdma (NFS/RDMA server) component allows a remote attacker to craft an RPC/RDMA Read chunk position field that bypasses validation. In the single-chunk path, a position past the inline body underflows the tail length, exposing adjacent slab memory to the up...
CVE-2026-89526 svcrdma: Validate Read chunk positions before reconstruction
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...
CVE-2026-89526 svcrdma: Validate Read chunk positions before reconstruction
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...
CVE-2026-89510 RDMA/cxgb4: Cancel reg_work before freeing device on remove
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...
CVE-2026-89510
CVE-2026-89510 is a use-after-free vulnerability in the Linux kernel's RDMA/cxgb4 (Chelsio) driver. When c4iw_remove() frees the device context (ctx->dev) while the reg_work work item—queued by c4iw_uld_state_change()—is still pending or executing, c4iw_register_device() may access already-fre...
EUVD-2026-76416
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...
CVE-2026-89509
CVE-2026-89509 affects the Linux kernel 's RDMA/ionic driver . The root cause is that the ionic driver was merged without adapting to the rdma_zalloc_drv_obj() API introduced by commit 7e53b31acc7f, which requires drivers to embed struct rdma_counter in a driver-specific struct and register its s...
EUVD-2026-76415
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...
CVE-2026-89509 RDMA/ionic: Embed counter driver data in rdma_counter allocation
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...
CVE-2026-89510 RDMA/cxgb4: Cancel reg_work before freeing device on remove
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...
CVE-2026-89510
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...
CVE-2026-89509 RDMA/ionic: Embed counter driver data in rdma_counter allocation
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...
CVE-2026-89509
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...
CVE-2026-89507
A race condition in the Linux kernel's RDMA/ucma subsystem affects the ucma_write_cm_event() function, which re-reads the ctx->file pointer four times without holding the handler lock. This allows ucma_migrate_id() to swap the pointer mid-sequence, leading to list corruption , a kernel BUG (cr...
CVE-2026-89508
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...
CVE-2026-89508
A race condition in the Linux kernel's RDMA/ucma component allows a local attacker with an RDMA device to trigger a use-after-free . The function ucma_set_ib_path() calls ucma_event_handler() without holding the handler lock; a concurrent ucma_migrate_id() can reassign ctx->file mid-operation,...
CVE-2026-89507 RDMA/ucma: Lock the handler in ucma_write_cm_event()
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...
EUVD-2026-76414
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...
EUVD-2026-76413
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...
CVE-2026-89508 RDMA/ucma: Lock the handler in ucma_set_ib_path()
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...