CVE-2026-90435 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix integer overflow of user QP buffer size
set_user_buf_size() computes the QP buffer size by left-shifting the user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, which is undefined behavior, and yields a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into.
Replace the shifts and addition with check_shl_overflow() and check_add_overflow(), rejecting invalid user inputs.
Moreover, guard the identical shift computing qp->sq.offset in _create_user_qp() before set_user_buf_size() is reached.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's InfiniBand subsystem contains a critical vulnerability within the mlx5 RDMA driver that stems from improper handling of signed integer arithmetic during queue pair buffer size calculation. Specifically, the function responsible for setting user buffer sizes performs left-shift operations on two user-supplied parameters: rq.wqe_cnt and rq.wqe_shift. These values are treated as signed integers, which introduces a risk of undefined behavior when large inputs are provided by an unprivileged user space process. In C programming standards, shifting a negative number or causing overflow in signed integer arithmetic is classified as undefined behavior, meaning the compiler may optimize code in unpredictable ways and the runtime result can be arbitrary rather than mathematically correct.
When rq.wqe_cnt reaches sufficiently large values, the left-shift operation results in an integer overflow that wraps around to produce either a small positive number or a negative value for the calculated buffer size. This miscalculation directly impacts the subsequent call to ib_umem_get(), which is responsible for mapping user memory into kernel space based on the computed size. Because the derived buf_size is erroneously smaller than what the hardware actually requires, the system maps only a fraction of the necessary memory region. Consequently, when the RDMA hardware attempts to write completion queue entries or other data structures associated with the work queue elements, it writes beyond the bounds of the mapped buffer into adjacent kernel memory regions.
This out-of-bounds write constitutes a severe security flaw that can lead to arbitrary code execution, privilege escalation, or denial of service conditions depending on what lies in the adjacent memory space and how the overwritten data is interpreted by subsequent system operations. The vulnerability aligns with CWE-190 Integer Overflow or Wraparound as it originates from arithmetic errors involving signed integers without adequate bounds checking prior to use. Furthermore, because this flaw allows an attacker who can submit RDMA work requests to corrupt kernel memory structures, it maps directly to MITRE ATT&CK technique T1203 Exploitation for Client Execution if the overflow leads to code execution in a client context, or more broadly to privilege escalation vectors where local users exploit kernel vulnerabilities to gain higher privileges.
The resolution involves replacing the unsafe shift and addition operations with robust helper functions check_shl_overflow() and check_add_overflow(). These helpers perform explicit checks before performing arithmetic operations that could result in overflow, ensuring that any input leading to an invalid buffer size is rejected early in the validation pipeline rather than propagating through the system. Additionally, a similar guard was implemented for the calculation of qp->sq.offset within _create_user_qp() to prevent identical issues on the send queue side before the main buffer sizing logic is reached. This dual-layered fix ensures that both receive and send queue parameters are validated against maximum allowable limits derived from hardware constraints and kernel memory management policies, thereby eliminating the possibility of triggering undefined behavior through maliciously crafted user inputs.
To mitigate this vulnerability in environments where patching may not be immediately feasible, administrators should restrict access to RDMA devices using appropriate Linux capabilities or cgroups, ensuring that only trusted processes can interact with mlx5 hardware interfaces. Implementing strict input validation at the application layer for any software interacting directly with these kernel APIs is also advisable as a defense-in-depth measure. However, the most effective remediation remains applying the upstream kernel patch that incorporates the overflow checks provided by the Linux security team, which addresses the root cause of the integer arithmetic flaw and prevents out-of-bounds memory access from occurring in production systems.