From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52F1F3E833B for ; Wed, 27 May 2026 12:21:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884517; cv=none; b=iDQojqEQggZWKmqnl0HRmSdZczZoUN3JQ0VVwvjHfK/hL+p4qAjG6GCLTo/DV/wysWRaLF6kQGR7snPS1ZNPguECiDP0I4+v0W/q5ZUPyaY9KTWDKb+AF0B/NPZxDAWf6trM+GudoCjzYUNn9yKPSuPl+/HYgD+LsrC6TSPs03s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884517; c=relaxed/simple; bh=NWvaToTwjh8Ero8fmOuFJcJqLVKHheD3s8R/hMlUerk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AI0eMxxMvo/Ha/AhgsRCBNh5x30kWRGMgTPBwcdoMjwLKwyBBfVjUDZ+FHo1Z+okMMeASkwHxht4YIKZU1/cv/3x84V4R4fK66ltJJHr3bIbtmczrat2Mp2LteP5bTdkLiBZiN9yaaNUBQX6zsg1jvTAukrqc9QDXdTkUDoAxbI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AIsmHfbZ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="AIsmHfbZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 931921F000E9; Wed, 27 May 2026 12:21:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779884516; bh=gfkbGOHmMcE6jPjgMywJHS4a8GIfN8BdonsWn+22dP8=; h=From:To:Cc:Subject:Date:Reply-To; b=AIsmHfbZ+zvNdgHv3f+v/30ScNvKzbioXT4lW4ugpf5mBai6m2m5wtnUdnypywuSJ DTeGB75d35VxJQXzMR+GcmkzWqC/SWvYniZhdZnx47eJA81Dz/5ZBXLy7eE4dvVfi/ LQPIKnARz7Pv65+mPr8Mb3xJdKEyBJZz34VYfr6w= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send Date: Wed, 27 May 2026 14:18:18 +0200 Message-ID: <2026052709-CVE-2026-45856-92b9@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4068; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=GvIcDPOSfpJd9N8RUTtvBqPS5j2rASwbvEbY+y7jAKc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFliDxmLT62VWHnXVZhv0sGj+R2svFkFma9t0+9Omuqq6 53mdudrRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzE04RhvtOm6q9HLqeLvLK2 3Kk9+cjxMrfjXxnmqT644N2emLFrbydfr8jTFUa3E0JrAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr). The Linux kernel CVE team has assigned CVE-2026-45856 to this issue. Affected and fixed versions =========================== Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 5.10.252 with commit 9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7 Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 5.15.202 with commit 9b5ac1c15334d46c0dbd49d64a2257b929500163 Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.1.165 with commit 01c9b152647dc70dc06a4a2eff86ebb3b3c76075 Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.6.128 with commit bf1feed1a7886af945f92890493aefd2b5c9928a Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.12.75 with commit d533425ac1f2925b4fc3e4ed9b9d72362cb23475 Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.18.14 with commit bf4454da8b1e712714628c0a0d6e7845bb40790a Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.19.4 with commit bef70ff9841990658610512b4a18e4a88c9b4df6 Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 7.0 with commit 1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-45856 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/infiniband/core/uverbs_cmd.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7 https://git.kernel.org/stable/c/9b5ac1c15334d46c0dbd49d64a2257b929500163 https://git.kernel.org/stable/c/01c9b152647dc70dc06a4a2eff86ebb3b3c76075 https://git.kernel.org/stable/c/bf1feed1a7886af945f92890493aefd2b5c9928a https://git.kernel.org/stable/c/d533425ac1f2925b4fc3e4ed9b9d72362cb23475 https://git.kernel.org/stable/c/bf4454da8b1e712714628c0a0d6e7845bb40790a https://git.kernel.org/stable/c/bef70ff9841990658610512b4a18e4a88c9b4df6 https://git.kernel.org/stable/c/1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0