CVE-2026-80880 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Properly support implicit ODP rereg_mr
Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing needs to be rebuilt if any change is requested. If the user does not specify a translation then force the implicit values which will then fall through the logic into mlx5_ib_reg_user_mr() to allocate a completely new MR.
Since implicit children were also touching the mr->pd, this removes another case where the access was racy.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel InfiniBand subsystem contains a critical implementation flaw within the Mellanox ConnectX driver regarding Implicit On-Demand Paging (ODP) memory region management. This vulnerability stems from an incorrect handling of parent Memory Keys when child keys are involved in an implicit ODP configuration. In standard operations, modifying attributes of a parent memory key might be permissible if it does not affect active mappings or security contexts. However, under the specific constraints of implicit ODP, multiple child memory keys rely on the state and permissions defined by their parent. The existing code attempted to modify these parameters in place without triggering a full reconstruction of the memory region structure. This approach fundamentally violates the integrity requirements for shared access control structures where concurrent modifications can lead to inconsistent states across different user-space processes or kernel threads interacting with the same underlying hardware resources.
The technical root cause lies in the failure to enforce atomicity and isolation during re-registration operations. When a change is requested that affects the parent memory key, the driver must rebuild the entire configuration rather than attempting incremental updates. The flawed logic allowed scenarios where changes were applied partially or without proper synchronization, leading to race conditions involving the Protection Domain (PD) associated with the memory region. Specifically, implicit child keys were accessing and potentially modifying mr->pd fields concurrently with other operations that expected a stable PD state. This lack of mutual exclusion creates a window for time-of-check-to-time-of-use vulnerabilities where one thread might read a permission set while another modifies it, resulting in undefined behavior or privilege escalation vectors through improper memory access controls.
From an operational impact perspective, this race condition poses significant risks to system stability and security integrity. An attacker with local user-level privileges could potentially exploit the timing window to bypass memory protection boundaries enforced by the Protection Domain. This could lead to unauthorized read/write access to kernel memory or other processes' data segments mapped through these InfiniBand memory regions. Furthermore, the inconsistency in state management can cause kernel panics or system crashes due to invalid pointer dereferences or corrupted internal structures within the mlx5 driver stack. The issue affects systems relying on high-performance computing workloads that utilize RDMA and ODP for zero-copy data transfers, making it particularly relevant for cloud infrastructure and HPC environments where such vulnerabilities could be leveraged for lateral movement or denial of service attacks against critical services.
Mitigation strategies must address both the immediate code defect and broader architectural safeguards. The primary fix involves ensuring that any modification to a parent memory key in an implicit ODP configuration triggers a complete reallocation and re-registration process via mlx5_ib_reg_user_mr(). This forces the creation of new Memory Regions with fresh, consistent states for all child keys, eliminating the possibility of stale or partially updated structures being used. Additionally, developers should enforce strict locking mechanisms around PD access to prevent concurrent modifications during critical sections. System administrators should apply kernel updates that include this patch immediately. For environments where immediate patching is not feasible, restricting user-level RDMA capabilities and monitoring for unusual memory mapping patterns can provide temporary risk reduction aligned with defense-in-depth principles recommended by industry standards such as CWE-362 for race conditions and MITRE ATT&CK techniques related to privilege escalation via kernel exploitation.