CVE-2026-92523

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) nldev component. This input validation vulnerability occurs because the RDMA_NLDEV_ATTR_STAT_HWCOUNTERS attribute's children are consumed without ensuring each payload is exactly one 32-bit unsigned integer (u32). A local attacker could exploit this by providing specially crafted input, potentially leading to unexpected system behavior or a denial of service.

This vulnerability is rated as having a Low impact because exploitation requires local access to send malformed netlink requests to the kernel's RDMA subsystem, restricting the impact primarily to a local denial of service without privilege escalation. Additionally, exposure is limited because the vulnerable netlink hardware counter interface is only exercised when InfiniBand or RDMA devices are configured and active on the host. Standard Red Hat Enterprise Linux deployments lacking RDMA networking hardware do not actively use this interface, minimizing overall risk across default installations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.