CVE-2026-90435

A flaw was found in the Linux kernel's RDMA/mlx5 component. A local attacker could exploit an integer overflow vulnerability when processing user-supplied buffer size values. This flaw occurs because large user inputs can cause an integer overflow during buffer size calculation, leading to a smaller buffer being allocated than required. Consequently, this can result in a buffer overflow, potentially allowing for memory corruption.

An integer overflow in RDMA/mlx5 user QP buffer size calculation can make ib_umem_get() map a buffer smaller than the size later used by the hardware. A local user with access to the mlx5 RDMA uverbs device can provide large rq wqe_cnt or shift values so the signed shift or size addition wraps and produces an incorrect small buffer size. This can lead to out of bounds hardware writes and memory corruption rather than a pure warning or resource leak. For the CVSS the PR:L is used because triggering requires a local process with access to the RDMA userspace verbs interface, not full administrative privileges. The issue is not directly network reachable. Impact is at least local denial of service and in the paranoid case may include confidentiality and integrity impact due to DMA backed memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.