{"schema":"threatline.record/2","record":{"id":"CVE-2026-97421","aliases":[],"summary":"RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()\n\nSeveral corner cases, especially important on 32 bits:\n\n- umem->iova is u64, the function argument should pass in u64 or\n  iova will be truncated\n- Check that the length is not too large for the iova\n- Check that lengths > 4G don't overflow the GENMASK","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","source_modified_at":"2026-10-03T10:58:13.282Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"3014da7587ce006cd08004fd6b257626b314e0a3","status":"affected","versionType":"git"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"ddccf6cc3861de2fe60986933bead79220e0d797","status":"affected","versionType":"git"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"e9bbb5f5349ef560ff6f0395564f04c3aa664559","status":"affected","versionType":"git"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"ae3cf7d2c4d506c5c91746321644e1a08d989e2a","status":"affected","versionType":"git"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"5fc5b73109540809b094710fac44da81dd8a3ff8","status":"affected","versionType":"git"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"09ea6837a0434fb4db99528a5055b6d822135dcf","status":"affected","versionType":"git"},{"version":"85e40ba1c4a5246b35e91c2ed69d4680426904d7","status":"affected","versionType":"git"},{"version":"59f07434b297e2268f5d5c567db5b09145245cf1","status":"affected","versionType":"git"},{"version":"488229b7729d7becf4c39c5e74fb709fb35115c2","status":"affected","versionType":"git"},{"version":"5.4.73","lessThan":"5.5","status":"affected","versionType":"semver"},{"version":"5.8.17","lessThan":"5.9","status":"affected","versionType":"semver"},{"version":"5.9.2","lessThan":"5.10","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","source_modified_at":"2026-10-03T10:58:13.282Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","source_modified_at":"2026-10-03T10:58:13.282Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"3014da7587ce006cd08004fd6b257626b314e0a3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","source_modified_at":"2026-10-03T10:58:13.282Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"5fc5b73109540809b094710fac44da81dd8a3ff8","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","source_modified_at":"2026-10-03T10:58:13.282Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"09ea6837a0434fb4db99528a5055b6d822135dcf","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","source_modified_at":"2026-10-03T10:58:13.282Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"5.5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","source_modified_at":"2026-10-03T10:58:13.282Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"5.9","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","source_modified_at":"2026-10-03T10:58:13.282Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"5.10","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00129,"percentile":0.02322,"score_date":"2026-10-23"},"published_at":"2026-09-24T16:03:31.505Z","modified_at":"2026-10-03T10:58:13.282Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97421","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T10:58:13.282Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97421","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/3014da7587ce006cd08004fd6b257626b314e0a3"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/ddccf6cc3861de2fe60986933bead79220e0d797"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/e9bbb5f5349ef560ff6f0395564f04c3aa664559"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/ae3cf7d2c4d506c5c91746321644e1a08d989e2a"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/5fc5b73109540809b094710fac44da81dd8a3ff8"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/09ea6837a0434fb4db99528a5055b6d822135dcf"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-03T10:58:13.282Z","content_hash":"9983460fae0c9f88501f99236a91f6a430536b00829539f80b7ae2728e14d6d5"}}