CVE-2026-89506 RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBSATTRUHW to UVERBSMETHODREGMR The original commit missed that three drivers mthca, irdma, siw have UHW data associated with regmr that cannot be passed through the ioctl. They also assume that the udata cann...

CVE-2026-89506

CVE-2026-89506 affects the Linux kernel RDMA/uverbs subsystem. The root cause is a missing UVERBS_ATTR_UHW attribute in the UVERBS_METHOD_REG_MR ioctl definition. Three drivers—mthca , irdma , and siw —associate UHW data with reg_mr but assume the udata pointer is non-NULL. Because the attribute ...

CVE-2026-89505

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...

CVE-2026-89505 RDMA/uverbs: Guard legacy bundles without method_elm

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...

EUVD-2026-76411

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...

CVE-2026-89505

CVE-2026-89505 is a vulnerability in the Linux kernel RDMA/uverbs subsystem. In the legacy write() path, the uverbs_attr_bundle passed to provider code does not contain an ioctl method element. If malformed provider input causes the common uverbs validation code to emit an error message, uverbs_g...

CVE-2026-89505 RDMA/uverbs: Guard legacy bundles without method_elm

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...

PT-2026-90221

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without method elm The legacy write path dispatches through a uverbs api write method, but the uverbs attr bundle passed to provider code does not have an ioctl method element. If malformed...

PT-2026-90247

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject connection when transport allocation fails handle connect req returns without action when svc rdma create xprt fails to allocate the new transport. The CM core returns 0 for CONNECT REQUEST events, so it does not...

PT-2026-90224

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma set ib path ucma set ib path calls ucma event handler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file f...

PT-2026-90246

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

PT-2026-90225

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdma counter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdma counter using rdma zalloc drv obj" requires drivers implementing counter ops to embed struct rdma counter in...

PT-2026-90222

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS ATTR UHW to UVERBS METHOD REG MR The original commit missed that three drivers mthca, irdma, siw have UHW data associated with reg mr that cannot be passed through the ioctl. They also assume that the udat...

PT-2026-90251

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma rn unregister before rdma destroy id svc rdma free caches rdma-sc cm id-device before teardown, then calls rdma destroy idsc cm id which frees the cm id. rpcrdma rn unregister follows, but between those t...

PT-2026-90242

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr count read segments checks only 4-byte...

PT-2026-90223

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma write cm event ctx-file may only be changed under the handler lock and the xa lock, which is what stops uevents being queued for a ctx while ucma migrate id moves it to another file. The CM cor...

kernel: nvmet-rdma: handle inline data with a nonzero offset

A flaw was found in the nvmet-rdma component of the Linux kernel. This vulnerability arises from incorrect handling of inline data with a non-zero offset, which can lead to an integer underflow. An attacker could exploit this to cause the system to read beyond its allocated memory, potentially...

Fedora 43 : valkey (2026-cda5ad190f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cda5ad190f advisory. Valkey 8.1.10 - Released Mon 31 August 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible. Securi...

kernel: nvmet-rdma: handle inline data with a nonzero offset

A flaw was found in the nvmet-rdma component of the Linux kernel. This vulnerability arises from incorrect handling of inline data with a non-zero offset, which can lead to an integer underflow. An attacker could exploit this to cause the system to read beyond its allocated memory, potentially...

kernel: RDMA/mana: Validate rx_hash_key_len

A flaw was found in the Linux kernel's RDMA/mana component. A local user could exploit this vulnerability by providing an invalid rxhashkeylen value through a user-space API uAPI structure. This invalid value is then used in a memcpy operation without proper bounds checking, allowing the user to...