CVE-2026-52908

A flaw was found in the Linux kernel. This vulnerability occurs during the re-registration of a Remote Direct Memory Access (RDMA) memory region. If the memory's access permissions are changed from read-only to read-write, the system may fail to properly update and secure the underlying user memory. This improper access control could allow unauthorized write operations to memory that should be protected.

RDMA rereg_mr could allow an existing user memory region to change from read only to writable access without rechecking that the underlying umem was pinned as writable. This can violate GUP and COW permission assumptions because the same pinned pages may later be exposed to writable RDMA access even though they were originally pinned read only. For the CVSS the PR:L is used because a local user or process with access to the RDMA uverbs device can request MR reregistration without full administrator privileges in many deployments. The issue is not directly network reachable because the vulnerable operation is a local RDMA control path operation. A remote RDMA peer may only become relevant after a local process exposes the MR and rkey. Impact is at least denial of service or memory corruption through unintended writes and may allow privilege escalation depending on the mapped memory and device configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.