CVE-2026-23243

Vulnerability

Overview

In the Linux kernel's RDMA subsystem, ib_umad_write computes the data_len parameter from user-controlled count and MAD header sizes. When a user supplies a mismatched MAD header size and RMPP header length, data_len can become negative and is passed to ib_create_send_mad(). This negative value leads to incorrect padding calculations that exceed the segment size, resulting in an out-of-bounds memset in alloc_send_rmpp_list() [1][2][3][3][4].

ExploitationAn attacker with local access and the ability to write to the /dev/infiniband/umad* device can craft a malicious ib_umad_write call. No special privileges beyond write access to the character device are required. The attacker controls the data length through the count argument, and by carefully choosing the MAD header and RMPP header sizes, they can force data_len to become negative [1].

ImpactA successful exploit writes up to 220 bytes of controlled data to a kernel heap buffer outside the allocated region. This out-of-bounds write can corrupt adjacent kernel memory, potentially leading to local privilege escalation or a system crash. The KASAN report confirms a slab-out-of-bounds write in ib_create_send_mad [1].

MitigationThe fix adds an explicit check in ib_umad_write to reject negative data_len values before creating the send buffer, preventing the vulnerability from being reached [1][2][3][4]. The patch has been applied to the stable kernel trees. Users should update to kernels containing the commit 52ab82cc5cf8 or later.