Linux kernel (drivers/infiniband/hw/irdma): A stale flag caused the CQ memory-registration path to read one element

Impact

A stale flag caused the CQ memory-registration path to read one element past the end of the page-address array on current-generation hardware, and to program whatever it read as the CQ shadow DMA address. That is both a kernel out-of-bounds read and an adapter pointed at an address derived from adjacent heap contents.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel irdma node registers CQ memory where the declared page count equals the region's page count - the normal case, not a crafted one. Local to the tenant; no fabric peer needed.

What to do

No fixed version is listed in the record - take the stable kernel carrying a80b3b13786e (or 3159c6fac43d / ad360a31092a) and reboot. Interim: drop /dev/infiniband/* from untrusted containers on irdma nodes.

References

Related entries

• Linux kernel (drivers/infiniband/hw/irdma): If copying the queue-pair response back to userspace fails, irdma'sCVE-2026-31492 · Linux kernel (drivers/infiniband/hw/irdma)Medium
• Linux kernel (drivers/infiniband/hw/irdma): A tenant that asks for a user QP while declaring a zero-size work-queueCVE-2026-68418 · Linux kernel (drivers/infiniband/hw/irdma)Medium
• Linux kernel (drivers/infiniband/hw/irdma): The driver signalled completion of control-plane requests through anCVE-2026-72494 · Linux kernel (drivers/infiniband/hw/irdma)Critical
• Linux kernel (drivers/infiniband/hw/irdma): In the physical-buffer-list allocator, a chunk is freed while still linkedCVE-2021-47614 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): Use-after-free on completion-queue teardown. The driver frees the CQCVE-2022-50137 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): The pseudo memory regions that back a QP/CQ/SRQ have no real hardware keyCVE-2026-68419 · Linux kernel (drivers/infiniband/hw/irdma)High