CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length
In the Linux kernel, the following vulnerability has been resolved:
RDMA/nldev: validate dynamic counter attribute length
RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32(). The top-level policy validates only the container, so it does not establish the fixed shape of each child.
Require every child payload to be exactly one u32 before reading it.
Event History
Frequently Asked Questions
What access would an attacker need to reach the vulnerable code path?
An attacker would need to submit a malformed nested RDMA netlink attribute for RDMA_NLDEV_ATTR_STAT_HWCOUNTERS. The provided information does not specify the required privilege level or whether this interface is reachable by unprivileged users.
How can I determine whether a system contains the fix?
Check whether the kernel includes the change that validates every child of RDMA_NLDEV_ATTR_STAT_HWCOUNTERS as an exact u32-sized payload before it is read with nla_get_u32(). The provided stable references identify commits containing the fix.
Is a mitigation available if the kernel cannot be updated immediately?
The provided information does not describe a workaround or configuration-based mitigation. Reducing access to the RDMA nldev netlink interface may limit exposure, but the required access controls are not specified in the available data.