All vulnerabilities
CVE-2026-93277

Linux: RDMA/bnxt_re: Validate udata before executing commands

Linux LinuxOperating systems
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Validate udata before executing commands

The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again, even though the driver resource has already been freed.

Call ib_no_udata_io() before teardown so udata failures are detected while the resource is still intact, then return success after teardown completes.

As part of this change, move ib_respond_empty_udata() to the start of the create and modify flows. While this is not strictly required for general create flows, as the core layer unwinds uobjects on failure, it is necessary for create AH. In _rdma_create_ah(), the HW object is otherwise leaked.

Text from CVE List

Affected versions 6

  • Linuxaffected: bed686d8dcd4fbcaa18cf67468caaf8772acfc7a before c5643ea4f040acc2f4d1e88f49bd0be51110ff2fCVE List
  • Linuxaffected: bed686d8dcd4fbcaa18cf67468caaf8772acfc7a before d38c835925d4a3bfdf0a85ff2829ee90c709c561CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2