CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Properly support implicit ODP reregmr
Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing needs to be rebuilt if any change is requested. If the user does not specify a translation then force the implicit values which will then fall through the logic into mlx5ibregusermr() to allocate a completely new MR.
Since implicit children were also touching the mr->pd, this removes another case where the access was racy.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's IB/mlx5 driver with implicit on-demand paging (ODP) memory registrations are relevant. The issue concerns rereg_mr operations on an implicit ODP configuration.
What operation triggers the vulnerable behavior?
The affected path is reached when a user requests changes through rereg_mr for a parent memory key in an implicit ODP setup. Because child memory keys exist, modifying the parent key in place can lead to unsafe handling, including a race involving mr->pd.
What is the remediation implemented by the fix?
The fix rebuilds the implicit ODP memory-registration setup rather than changing the parent memory key in place. When no translation is specified, it forces implicit values and allocates a completely new memory region through mlx5_ib_reg_user_mr().