CVE-2026-80880

A flaw was found in the Linux kernel's IB/mlx5 component. Improper handling of implicit On-Demand Paging (ODP) memory registration (rereg_mr) and interactions with child memory keys can lead to a race condition. This occurs because changes to a parent memory key necessitate a complete rebuild, and implicit child keys can concurrently access the memory protection domain (mr->pd). This race condition could result in unpredictable system behavior or potential memory corruption.

RDMA/mlx5 implicit ODP rereg_mr can race with child mkeys because the parent memory region may be changed in place while child objects still depend on the parent protection domain and translation state. A local user with access to RDMA uverbs can request rereg_mr on an implicit ODP MR and may trigger stale or inconsistent kernel object access during concurrent ODP activity. For the CVSS the PR:L is used for the paranoid score because reliable triggering requires a local process able to use the RDMA device, but this is often available to non root users through uverbs permissions or RDMA service accounts. The issue is not directly network reachable because rereg_mr is a local control path operation. Impact is at least denial of service and in worst case may include confidentiality or integrity impact due to a plausible use-after-free or stale pointer race around kernel RDMA objects.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.