CVE-2026-97421

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem. Boundary conditions in the user memory page size calculation function fail to properly handle large memory lengths and address sizes, particularly on 32-bit architectures. A local user could exploit these integer truncation and overflow conditions when mapping user memory, potentially causing memory corruption or a Denial of Service (DoS) through a system crash.

A moderate-impact flaw was found in the Linux kernel's RDMA subsystem as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform (through the RHEL CoreOS kernels). Boundary conditions in ib_umem_find_best_pgsz() are mishandled when RDMA user memory is registered: the 64-bit umem->iova value is truncated when passed to a narrower function argument, the memory-region length is not validated against the IOVA range, and lengths greater than 4 GB can overflow the GENMASK page-size mask. These conditions are especially significant on 32-bit architectures. A local user with access to RDMA user verbs devices who registers memory with a crafted address or length could trigger these integer truncation and overflow conditions, causing an incorrect page size to be selected, which may make the RDMA operation fail or crash the kernel, resulting in a denial of service. Red Hat assesses this flaw as Moderate severity (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the demonstrated impact is limited to availability; the upstream CVE record scores it 7.8 (Important) including high confidentiality and integrity impacts that the available evidence does not demonstrate. Red Hat Enterprise Linux 6 ELS, Red Hat Enterprise Linux 7 ELS, and Red Hat Enterprise Linux 8.4 are not affected because the vulnerable code is not present in those streams. For the affected streams, the fix is deferred because exploitation requires local access to an RDMA-capable device and the established impact is limited to availability; the residual risk is that a local user able to register RDMA memory regions could crash the kernel, causing a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.