{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-97421",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-97421"
  ],
  "published": "2026-09-24T16:08:25Z",
  "summary": "RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()\n\nSeveral corner cases, especially important on 32 bits:\n\n- umem->iova is u64, the function argument should pass in u64 or\n  iova will be truncated\n- Check that the length is not too large for the iova\n- Check that lengths > 4G don't overflow the GENMASK",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.189",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97421"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3014da7587ce006cd08004fd6b257626b314e0a3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ddccf6cc3861de2fe60986933bead79220e0d797"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e9bbb5f5349ef560ff6f0395564f04c3aa664559"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ae3cf7d2c4d506c5c91746321644e1a08d989e2a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5fc5b73109540809b094710fac44da81dd8a3ff8"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/09ea6837a0434fb4db99528a5055b6d822135dcf"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-10-03T11:04:09Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - Attacker-controlled cmd.hca_va and cmd.length reach ib_umem_find_best_pgsz() via open of /dev/infiniband/uverbsX, then ib_uverbs_write(IB_USER_VERBS_CMD_REG_MR)/ib_uverbs_reg_mr() or UVERBS_METHOD_REG_MR ioctl, then pd->ops.reg_user_mr() (mlx5_ib_reg_user_mr/irdma_reg_user_mr/efa_register_mr). Remote RDMA packets do not supply virt or umem->length.\nAC:L - ib_uverbs_reg_mr() only requires (start & ~PAGE_MASK)==(hca_va & ~PAGE_MASK), so the attacker picks hca_va near 2^63 or U64_MAX with a small pinned region and makes (umem->length-1+virt) overflow or bits_per() return BITS_PER_LONG, hitting the unguarded GENMASK() deterministically with no race.\nPR:L - uverbs_devnode() creates /dev/infiniband/uverbs* mode 0666 and ib_uverbs_open() has no capability check (only rdma_dev_access_netns). ib_umem_get_va() needs can_do_mlock() (RLIMIT_MEMLOCK!=0) and ib_check_mr_access(); CAP_SYS_ADMIN/CAP_IPC_LOCK are not required.\nUI:N - After opening uverbs the attacker allocates a PD and issues IB_USER_VERBS_CMD_REG_MR or UVERBS_METHOD_REG_MR with their own start, length, and hca_va; no victim mount or other user action is required.\nS:U - A wrong page size or truncated umem->iova from ib_umem_find_best_pgsz() misprograms that host's RDMA MTT/PBL. This stays in the kernel/device memory-management authority and is not a KVM/Xen guest-to-host escape or IOMMU VM-boundary bypass.\nC:H - When bits_per((umem->length-1+virt)^virt)>=BITS_PER_LONG, GENMASK(BITS_PER_LONG-1, bits) is invalid and mask can be 0, so the function returns rounddown_pow_of_two(pgsz_bitmap) (largest HW page). mlx5_ib_populate_pas()/rdma_umem_for_each_dma_block() then install oversized MTT/PBL entries, so the NIC DMA-reads physical memory beyond the pinned umem.\nI:H - The same oversized page size is programmed into hardware (efa_register_mr params.page_shift, ionic_pgtbl_init, mlx5 mkey PAS). With IB_ACCESS_LOCAL_WRITE or IB_ACCESS_REMOTE_WRITE from the REG_MR access_flags, the device DMA-writes outside the registered region, which is an arbitrary physical write.\nA:H - GENMASK() with l>h is a shift UB that can oops (UBSAN) or yield mask==0; mis-sized pages cause IOMMU/device faults. ib_umem_is_contiguous() (mlx5_ib_db_map_user_desc, efa create_cq) can also treat a non-contiguous umem as one DMA block and fault the kernel or NIC."
    }
  }
}