CVE-2026-92495 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time.
Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the Linux kernel's RDMA bnxt_re driver represents a critical flaw in memory management permissions during the mapping of Device Buffer Ring and Toggle Page regions. The core issue stems from an inconsistency between the immediate access restrictions applied at the time of memory mapping and the underlying potential for future modification. Specifically, while the bnxt_re_mmap function correctly rejects VM_WRITE requests to prevent direct write operations on these specific pages, it fails to clear the VM_MAYWRITE flag in the resulting virtual memory area structure. This oversight creates a security gap where userspace processes can establish read-only mappings that technically retain the capability for future write access through standard system calls.
This architectural flaw allows an attacker or malicious application to bypass intended isolation boundaries by leveraging the mprotect system call with PROT_WRITE after initially obtaining a read-only mapping of these kernel-managed pages. Since the VM_MAYWRITE flag remains set, the operating system's memory protection mechanisms do not prevent the transition from read-only to read-write access at runtime. This effectively nullifies the security controls implemented in the mmap handler, as the initial check only validates permissions during the creation of the mapping rather than enforcing them persistently throughout the lifetime of the mapped region. Such a bypass mechanism undermines the integrity of the RDMA subsystem by allowing unauthorized modifications to memory regions that are intended for kernel-controlled or read-only interaction.
From an operational impact perspective, this vulnerability poses significant risks related to data integrity and system stability. The DBR and Toggle Page structures are integral to the operation of the Broadcom NetXtreme-C/E RoCE adapter driver, managing how hardware interacts with software buffers. Unauthorized write access could allow a local user to corrupt these control structures, potentially leading to denial of service conditions by disrupting network operations or causing kernel panics due to invalid memory states. Furthermore, in multi-tenant environments where RDMA resources are shared, this flaw could enable privilege escalation scenarios if an attacker can manipulate hardware state to gain unauthorized access to other users' data buffers or bypass isolation mechanisms enforced by the virtualization layer.
The remediation for this issue involves modifying the bnxt_re_mmap function to explicitly clear the VM_MAYWRITE flag before calling vm_insert_page within the shared DBR and toggle-page branches of the code. This change aligns the persistent memory permissions with the immediate access restrictions, ensuring that once a mapping is established as read-only, it cannot be upgraded to write-access by userspace applications. This fix reinforces the principle of least privilege for kernel-managed memory regions and ensures that security policies are enforced consistently across both initial mapping and subsequent modification attempts.
This vulnerability aligns with CWE-270, which describes Privilege Confusion: Mixing User and Non-User Contexts, as it involves a failure to properly restrict permissions based on the context of access. It also relates to CWE-941, Misinterpretation of Removed Security Functionality, where the removal of write capability at mmap time is not reflected in the persistent state of the memory mapping object. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques associated with Defense Evasion and Privilege Escalation on Linux systems, specifically those involving memory manipulation to bypass access controls. Security practitioners should ensure that kernel updates incorporating this fix are applied promptly to mitigate the risk of local exploitation via mprotect-based privilege escalation attacks against RDMA-enabled systems.