CVE-2026-90435: RDMA/mlx5: Fix integer overflow of user QP buffer size
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix integer overflow of user QP buffer size
setuserbufsize() computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signed integer overflow, which is undefined behavior, and yields a small or negative bufsize, causing ibumemget() to map a buffer smaller than the hardware will actually write into.
Replace the shifts and addition with checkshloverflow() and checkaddoverflow(), rejecting invalid user inputs.
Moreover, guard the identical shift computing qp->sq.offset in createuserqp() before setuserbufsize() is reached.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to trigger this issue?
An attacker needs to be able to submit user QP creation inputs through the RDMA/mlx5 user QP path, including the receive-queue WQE count and shift values. The issue is triggered by sufficiently large user-supplied values.
What is the practical effect of the overflow?
The overflow can make the calculated QP buffer size small or negative, causing ib_umem_get() to map less memory than the hardware is expected to write. This creates a mismatch between the mapped buffer and the hardware write size.
What validation does the resolved code add?
The fix uses checked shift and addition operations when calculating the user QP buffer size and rejects invalid inputs. It also guards the equivalent shift used to compute qp->sq.offset before the buffer-size calculation is reached.