CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap
bnxtremmap() rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotect(PROTWRITE). This can bypass the write check that only runs at mmap time.
Clear VMMAYWRITE before vminsertpage() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the fix in RDMA/bnxt_re so that VM_MAYWRITE is cleared on the DBR_PAGE and TOGGLE_PAGE mmap shared DBR/toggle-page before vm_insert_page(), preventing bypass of the write check.
Linux kernel (RDMA/bnxt_re) vm flags on DBR_PAGE and TOGGLE_PAGE mmap (VM_MAYWRITE) = Clear VM_MAYWRITE before vm_insert_page() - Configuration
Update bnxt_re_mmap() so that DBR_PAGE and TOGGLE_PAGE mmap rejects VM_WRITE and so that a read-only mapping cannot retain VM_MAYWRITE (enforce existing policy at mmap time).
bnxt_re_mmap() mmap permissions behavior for DBR_PAGE and TOGGLE_PAGE = Reject VM_WRITE; ensure read-only mapping does not retain VM_MAYWRITE
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs userspace access to create a read-only mapping of a bnxt_re DBR or toggle page, then change that mapping to writable with mprotect(PROT_WRITE). The issue affects the shared DBR/toggle-page mmap path because the write check was performed only when mmap was created.
Who is realistically exposed?
Systems using the Linux kernel bnxt_re RDMA driver and exposing its DBR or toggle-page mappings to userspace are the relevant population. The issue does not apply merely because RDMA is present; the affected mmap functionality must be used.
What is the mitigation if the fix cannot be applied immediately?
The provided information identifies userspace write upgrades via mprotect(PROT_WRITE) as the bypass path. Restricting untrusted users from accessing the affected bnxt_re DBR/toggle-page mappings reduces exposure.