Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Several corner cases, especially important on 32 bits: - umem->iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the length is not too large for the iova - Check that lengths > 4G don't overflow the GENMASK

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:19.993Z",
  "pubdate": "2026-09-24T17:17:19.993Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel RDMA subsystem, specifically within the ib_umem_find_best_pgsz() function, concerning improper handling of boundary conditions during memory alignment calculations.\nThe vulnerability is categorized as an integer overflow and truncation issue, primarily impacting 32-bit system architectures.\nThe root cause lies in the insufficient handling of 64-bit IOVA addresses and memory length parameters, which can lead to calculation errors when determining optimal page sizes.\nAn attacker capable of triggering this code path could potentially cause memory corruption or bypass security checks related to memory regions.\nThe risk is heightened on 32-bit platforms where integer truncation occurs during the handling of u64 iova values.\nExploitation requires an attacker to interact with the RDMA subsystem, likely through a user-space interface, to provide specifically crafted input that triggers the flawed boundary checks.\nThis vulnerability highlights a critical need for rigorous arithmetic validation when dealing with memory management structures in kernel-space drivers.",
  "technicalDetails": "The vulnerability manifests within the ib_umem_find_best_pgsz() function, which is responsible for calculating the best page size for RDMA user memory regions based on input IOVA addresses and total length.\nThe technical root cause involves three distinct boundary condition failures: first, the function fails to correctly treat the umem->iova parameter as a u64, leading to truncation on 32-bit systems where the architecture may not natively handle these conversions without explicit casting or widened register usage. This truncation results in an incorrect base address calculation for the memory region.\nSecond, the function lacks robust validation against the provided length parameter relative to the starting IOVA, which could allow for out-of-bounds calculations if the sum of the address and length exceeds the addressable memory space or valid alignment boundaries.\nThird, the logic fails to adequately check if lengths exceeding 4GB cause an integer overflow when interacting with the GENMASK macro. Because GENMASK expects specific bit ranges, providing an excessive length can cause the mask generation to wrap or produce erroneous bitwise results, leading to an incorrect page size selection.\nThe attack flow involves a malicious actor crafting an RDMA memory registration request containing specifically sized buffers and non-aligned addresses. By passing an IOVA that is improperly truncated or a length that triggers the GENMASK overflow, the attacker influences the kernel's internal page mapping logic.\nAs the kernel proceeds to use these erroneous values to configure RDMA hardware or page table entries, it may result in incorrect memory access permissions, mapping overlapping memory regions, or leaking kernel memory contents to the user-space context.\nBecause the function is part of the core RDMA infrastructure, the vulnerability is exposed whenever user-space applications invoke RDMA verb operations that trigger memory registration. Privilege requirements are limited to those necessary to open and interact with the RDMA device file descriptors, which are typically restricted to users with direct access to hardware interfaces."
}