High · published March 18, 2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/umad: Reject negative data_len in ib_umad_write
ib_umad_write computes data_len from user-controlled count and the
MAD header sizes. With a mismatched user MAD header size and RMPP
header length, data_len can become negative and reach ib_create_send_mad().
This can make the padding calculation exceed the segment size and trigger
an out-of-bounds memset in alloc_send_rmpp_list().
Add an explicit check to reject negative data_len before creating the
send buffer.
KASAN splat:
[ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0
[ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102
[ 211.365867] ib_create_send_mad+0xa01/0x11b0
[ 211.365887] ib_umad_write+0x853/0x1c80
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.24.1, < 5.10.252 | 5.10.252 |
| linux/linux_kernel | ≥ 5.11, < 5.15.202 | 5.15.202 |
| linux/linux_kernel | ≥ 5.16, < 6.1.165 | 6.1.165 |
| linux/linux_kernel | ≥ 6.2, < 6.6.128 | 6.6.128 |
| linux/linux_kernel | ≥ 6.7, < 6.12.75 | 6.12.75 |
| linux/linux_kernel | ≥ 6.13, < 6.18.14 | 6.18.14 |
| linux/linux_kernel | ≥ 6.19, < 6.19.4 | 6.19.4 |
| linux/linux_kernel | all versions | — |