SB20260918245 - Integer overflow in Linux kernel hw mlx5 driver
Published: September 18, 2026
Security Bulletin ID
SB20260918245
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Integer overflow (CVE-ID: CVE-2026-90435)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to integer overflow in the mlx5 RDMA driver's set_user_buf_size() function when processing user-supplied QP buffer parameters. A local user can supply an excessively large rq.wqe_cnt value to cause memory corruption.
The same unchecked shift calculation is also used to compute qp->sq.offset during user QP creation.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/42fb8aefffff5b458aaa66803364a16e0ea44129
- https://git.kernel.org/stable/c/5b6cfc6d7ff0959dd9766fdc24286a253b59ca77
- https://git.kernel.org/stable/c/c845e5e05140ea1bc64a5b1107942d93c876034d
- https://git.kernel.org/stable/c/ccce6b7ef1d7efc59ccba3421e1339c6e63a3d20
- https://git.kernel.org/stable/c/d7fa2ff72ad1861eac194a4e0075d504ba8c246e
- https://git.kernel.org/stable/c/d99622e40aaa910ade681dfd4dc0fa240a011331
- https://git.kernel.org/stable/c/dec47e4b0fe34afdf38caa72b4408ba95502e5de
- https://git.kernel.org/stable/c/f917707f0de0832b8ab582391b1f64e549995c6c