CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap
bnxtremmap() rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotect(PROTWRITE). This can bypass the write check that only runs at mmap time.
Clear VMMAYWRITE before vminsertpage() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Clear VM_MAYWRITE before vm_insert_page() in the shared DBR_PAGE/TOGGLE_PAGE mmap branch so read-only mappings cannot be upgraded with mprotect(PROT_WRITE).
Linux kernel RDMA/bnxt_re mmap handling VM_MAYWRITE = clear
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs userspace access to create a read-only mapping of a bnxt_re DBR or toggle page, then change that mapping to writable with mprotect(PROT_WRITE). The issue affects the shared DBR/toggle-page mmap path because the write check was performed only when mmap was created.
Who is realistically exposed?
Systems using the Linux kernel bnxt_re RDMA driver and exposing its DBR or toggle-page mappings to userspace are the relevant population. The issue does not apply merely because RDMA is present; the affected mmap functionality must be used.
What is the mitigation if the fix cannot be applied immediately?
The provided information identifies userspace write upgrades via mprotect(PROT_WRITE) as the bypass path. Restricting untrusted users from accessing the affected bnxt_re DBR/toggle-page mappings reduces exposure.