Heimdall Security Logo

CVE-2026-31425

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, <=6.12.*, <450ec93c0f172374acbf236f1f5f02d53650aa2d, 0, <4.6, 6.6.134, 7.0, <23e07c340c445f0ebff7757ba15434cb447eb662, <6b0a8de67ac0c74e1a7df92b73c862cb36780dfc, <82e4a3b56b23b844802056c9e75a39d24169b0a4, <47de5b73db3b88f45c107393f26aeba26e9e8fae, <=5.10.*, <=6.6.*, <=6.19.*, <a54ecccfae62c5c85259ae5ea5d9c20009519049, 5.15.203, <c506456ebf84c50ed9327473d4e9bd905def212b, 4.6, 1659185fb4d0025835eb2058a141f0746c5cab00, <=6.18.*, 6.12.81, <a5bfd14c9a299e6db4add4440430ee5e010b03ad, <=*, 5.10.253, <=5.15.*, 6.1.168, 6.18.22, 6.19.12

Description

In the Linux kernel, the following vulnerability has been resolved: rds: ib: reject FRMR registration before IB connection is established rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with i_cm_id = NULL because the connection worker has not yet called rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses the control message before any connection establishment, allowing rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the kernel. The existing guard in rds_ib_reg_frmr() only checks for !ic (added in commit 9e630bcb7701), which does not catch this case since ic is allocated early and is always non-NULL once the connection object exists. KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920 Call Trace: rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167) rds_ib_map_frmr (net/rds/ib_frmr.c:252) rds_ib_reg_frmr (net/rds/ib_frmr.c:430) rds_ib_get_mr (net/rds/ib_rdma.c:615) __rds_rdma_map (net/rds/rdma.c:295) rds_cmsg_rdma_map (net/rds/rdma.c:860) rds_sendmsg (net/rds/send.c:1363) ____sys_sendmsg do_syscall_64 Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all non-NULL before proceeding with FRMR registration, mirroring the guard already present in rds_ib_post_inv(). Return -ENODEV when the connection is not ready, which the existing error handling in rds_cmsg_send() converts to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to start the connection worker.

Gravité et risque d'exploitation

CVE-2026-31425 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.16 %, ce qui la place devant 5.1 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, <=6.12.*, <450ec93c0f172374acbf236f1f5f02d53650aa2d, 0, <4.6, 6.6.134, 7.0, <23e07c340c445f0ebff7757ba15434cb447eb662, <6b0a8de67ac0c74e1a7df92b73c862cb36780dfc, <82e4a3b56b23b844802056c9e75a39d24169b0a4, <47de5b73db3b88f45c107393f26aeba26e9e8fae, <=5.10.*, <=6.6.*, <=6.19.*, <a54ecccfae62c5c85259ae5ea5d9c20009519049, 5.15.203, <c506456ebf84c50ed9327473d4e9bd905def212b, 4.6, 1659185fb4d0025835eb2058a141f0746c5cab00, <=6.18.*, 6.12.81, <a5bfd14c9a299e6db4add4440430ee5e010b03ad, <=*, 5.10.253, <=5.15.*, 6.1.168, 6.18.22, 6.19.12) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE