PT-2026-26046 · Linux · Linux

Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-23243

NVD

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umad: Reject negative data len in ib umad write

ib umad write computes data len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data len can become negative and reach ib create send mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc send rmpp list().

Add an explicit check to reject negative data len before creating the send buffer.

KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib create send mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray thread/102 [ 211.365867] ib create send mad+0xa01/0x11b0 [ 211.365887] ib umad write+0x853/0x1c80

Related Identifiers

CVE-2026-23243

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-23243 · Security Note
• https://git.kernel.org/stable/c/9c80d688f402539dfc8f336de1380d6b4ee14316 · Note
• https://git.kernel.org/stable/c/a6a3e4af10993cb9e4b8f0548680aba0ab5f3b0d · Note
• https://git.kernel.org/stable/c/5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 · Note
• https://git.kernel.org/stable/c/6eb2919474ca105c5b13d19574e25f0ddcf19ca2 · Note
• https://git.kernel.org/stable/c/52ab82cc5cf8ada5c3fb6ffe8f32fdb2fc27a34b · Note
• https://git.kernel.org/stable/c/1371ef6b1ecf3676b8942f5dfb3634fb0648128e · Note
• https://git.kernel.org/stable/c/362e45fd9069ffa1523f9f1633b606ebf72060d7 · Note
• https://git.kernel.org/stable/c/205955f29c26330b1dc7fdeadd5bb97c38e26f56 · Note