Linux kernel (drivers/infiniband/hw/irdma): The page-address copy loop only honoured its bound when the bound was

CVSS 7.8CVE-2026-74390Firmware, BMC & network fabriccurated

Impact

The page-address copy loop only honoured its bound when the bound was non-zero, so in the flat (level 0) case it kept writing until it ran out of user DMA blocks - past the end of a fixed four-entry array. A tenant that registers more pages than it declared gets a controlled kernel out-of-bounds write, which is a container-to-host escalation primitive.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel E810/irdma node creates a CQ, QP or SRQ declaring a small page count (e.g. req.cq_pages) while supplying a user memory region made of more DMA blocks. Entirely local to the tenant - no fabric peer, no host root.

What to do

Update to a stable kernel carrying 4780f58672ee (or 79a20a8e201a / 9f8f0d2099e3) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on irdma nodes, or blacklist the irdma module where RDMA is not required.

References

https://git.kernel.org/stable/c/4780f58672ee6328accd54a95f9c00683477e499 https://git.kernel.org/stable/c/79a20a8e201a779224b4bf115250a7713bde72c0 https://nvd.nist.gov/vuln/detail/CVE-2026-74390

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.