Linux kernel RDMA core (ib_uverbs post_send / post_recv command parsing): The uverbs write path multiplied two fully

Impact

The uverbs write path multiplied two fully user-controlled u32 fields (wqe_size x wr_count) without overflow checking, and fed the wrapped result to the request-buffer walker. A tenant picks the two values so the product wraps, the length check passes, and the kernel then walks past the end of the copied command buffer. Same shape applies to sge_count x sizeof(ib_uverbs_sge). This is the front door of the verbs API - it is what every RDMA application calls to post work - so no unusual capability or device is required beyond the uverbs node the tenant already has.

Who can reach it

Local write() on /dev/infiniband/uverbs*, i.e. any container doing RDMA. Unprivileged.

What to do

Kernel update that reorders the bound check in uverbs_request_next_ptr() so the user-controlled length is compared alone, and converts the callers to size_mul(). No runtime toggle exists - the only alternative is denying uverbs to tenants, which disables RDMA.

References

Related entries

• GRUB2 (squashfs): Integer overflow in the squash4 filesystem module leading to out-of-bounds write and possible SecureCVE-2025-0678 · GRUB2 (squashfs)High
• Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/steering/hws): A matcher that fails to disconnect is reinsertedCVE-2025-21751 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/steering/hws)High
• Linux kernel mlx5_core eswitch vport QoS scheduling: When enabling per-vport QoS fails, the scheduling node is leakedCVE-2025-21882 · Linux kernel mlx5_core eswitch vport QoS schedulingHigh
• Linux x86/microcode/AMD - out-of-bounds on CPU-less NUMA nodes: The AMD microcode loader iterated every NUMA nodeCVE-2025-21991 · Linux x86/microcode/AMD - out-of-bounds on CPU-less NUMA nodesHigh
• Linux kernel RDMA core (hw_counters sysfs exposure across network namespaces): RDMA hardware counter sysfs attributesCVE-2025-22089 · Linux kernel RDMA core (hw_counters sysfs exposure across network namespaces)High
• Dell SmartFabric OS10 (command injection with elevated privileges): Local low-privilege attacker executes commandsCVE-2025-22472 · Dell SmartFabric OS10 (command injection with elevated privileges)High