UBUNTU-CVE-2026-92525: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe->dma.sge[] For a user QP, qp->sq.queue is a ring the application writes directly, so rxepostsend() takes the isuser branch and only schedules sendtask without validating the WQE. rxerequester() consumes it in place via reqnextwqe() and calls copydata(), which indexes &wqe->dma.sge[cursge] with the attacker-controlled numsge/cursge. Only the kernel path bounds numsge (validatesendwr()); the user WQE is never checked, so a local unprivileged user can post a WQE with an out-of-range cursge or oversized numsge and force an out-of-bounds read of the per-WQE sge array in copydata() (vmalloc OOB read, local DoS). Bound numsge to qp->sq.maxsge in rxerequester() before use, the way getsrqwqe() already guards SRQ entries, and bound cursge only when the WQE carries payload (dma.resid): copydata() returns early on a zero-length copy before touching dma->sge[], so a zero-payload WQE -- the only kind a maxsge == 0 QP can post -- stays valid. Reproduced under KASAN; the vmalloc-out-of-bounds in copydata() is gone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In RDMA/rxe rxe_requester(), bound num_sge to qp->sq.max_sge before indexing or using the WQE SGE array, and validate cur_sge only when the WQE carries payload (dma.resid), since copy_data() returns early for zero-length copies.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local unprivileged user who can post work queue entries to a user RDMA RXE queue pair is the relevant attacker. The user queue pair's send queue is directly writable by the application, allowing attacker-controlled SGE fields to reach the requester path without the kernel-side validation used for kernel work requests.
What malformed input is required to trigger the fault?
An attacker can supply an oversized num_sge value or an out-of-range cur_sge value in a work queue entry. The cur_sge value is only dereferenced for work queue entries carrying payload data, because zero-length copies return before accessing the SGE array.
Are queue pairs with max_sge set to zero affected by the cur_sge condition?
A max_sge == 0 queue pair can post only zero-payload work queue entries. Those entries remain valid because copy_data() returns without accessing dma.sge[] when there is no payload.