CVE-2026-92495

CVE-2026-92495

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap

flags, but a read-only mapping can still retain VM_MAYWRITE. nd later

be upgraded with mprotect(PROT_WRITE). This can bypass the write check

that only runs at mmap time.

Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page

branch, matching the existing policy that userspace writes are not

expected for these pages.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Published
2026-09-17T21:17Z
References (5)
https://git.kernel.org/stable/c/0afbfe019c881483337d9f8304e678af05ebe7cc · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/518df61b9b0a5b288dfa72c87246045329c18b8c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5361fb1e5bc246f9a2c0721543f72c8dac200769 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:10Z
    RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
    cvelistv5