CVE-2026-92523 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/nldev: validate dynamic counter attribute length
RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are consumed directly with nla_get_u32(). The top-level policy validates only the container, so it does not establish the fixed shape of each child.
Require every child payload to be exactly one u32 before reading it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Remote Direct Memory Access subsystem contains a validation deficiency within its netlink device interface that allows for improper handling of dynamic counter attributes. Specifically, the attribute identified as RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is structured as a nested container where individual child elements are processed directly using nla_get_u32 without sufficient prior verification of their payload size. While the top-level policy correctly validates the overall structure of the container, it fails to enforce constraints on the internal composition of each child element. This oversight means that if a user-space application provides a malformed or oversized attribute within this nested list, the kernel will attempt to interpret arbitrary amounts of data as a standard unsigned thirty-two-bit integer rather than rejecting the input due to length mismatch.
This technical flaw constitutes an out-of-bounds read vulnerability because nla_get_u32 assumes that the provided netlink attribute contains at least four bytes of payload data corresponding to the size of a u32 type. When child attributes are shorter than expected, or when their boundaries are not strictly enforced against this fixed width, the kernel may read memory beyond the intended buffer limits. In severe cases where crafted input allows for precise control over adjacent memory structures, such improper length validation can lead to information disclosure by leaking kernel stack contents or heap data into user-space responses. Furthermore, if the malformed attribute triggers subsequent logic that relies on the interpreted value being valid and within expected bounds, it could potentially contribute to instability or denial of service conditions through unexpected code paths triggered by invalid integer conversions.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation as the root cause lies in the failure to adequately sanitize and verify incoming data structures before processing. Additionally, because the flaw resides within a network-facing interface that accepts input from user-space applications which may be unprivileged or compromised, it relates to CWE-787 Out-of-bounds Read. In terms of adversary behavior mapping under MITRE ATT&CK for Linux, this type of vulnerability facilitates techniques associated with Discovery and potentially Privilege Escalation if the leaked information aids in further exploitation steps against kernel memory protections such as KASLR or SMEP. The lack of strict length checks on nested attributes represents a common pattern where developers assume structural integrity based on parent-level validation rather than enforcing atomic constraints on each individual data element within complex protocols like netlink.
The operational impact of this vulnerability is primarily centered around the potential for local information disclosure and system instability. An attacker with access to the RDMA subsystem interfaces can craft specific netlink messages containing malformed HWCOUNTERS attributes to trigger these out-of-bounds reads. While direct remote code execution via this specific flaw may be difficult due to the read-only nature of the primary issue, the ability to leak kernel memory significantly reduces the effectiveness of security mitigations like Address Space Layout Randomization. This leakage can provide attackers with critical addresses needed for subsequent exploitation attempts against other vulnerabilities in the same or related subsystems. Consequently, maintaining system integrity and confidentiality requires addressing this input validation gap immediately.
To mitigate this vulnerability, it is essential to enforce strict length checks on every child attribute within the RDMA_NLDEV_ATTR_STAT_HWCOUNTERS nested structure before attempting to extract data using nla_get_u32. Developers should implement a loop that iterates through each nested element and verifies that its payload size exactly matches sizeof(u32). If any child attribute deviates from this expected length, the kernel must reject the entire request with an appropriate error code such as EINVAL rather than proceeding to parse the malformed data. This approach ensures that only well-formed inputs are processed by the lower-level extraction functions, thereby eliminating the possibility of reading beyond allocated buffer boundaries. Additionally, applying similar rigorous validation patterns across other netlink attributes in the RDMA subsystem can prevent analogous flaws from being introduced elsewhere in the codebase.