« Volver al listado

CVE-2026-90218

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cma: Fix WARNING in res_to_rt

syzbot reported a WARN_ON(!res->dev) in res_to_rt() triggered via addr_handler() during asynchronous address resolution:

In addr_handler(), cma_acquire_dev_by_src_ip() is called to populate id_priv->cma_dev and bind the associated ib_device to id_priv->id.device. If cma_acquire_dev_by_src_ip() returns an error (non-zero status), the ID remains unassociated with any RDMA device.

Previously, rdma_restrack_add(&id_priv->res) was invoked unconditionally even when cma_acquire_dev_by_src_ip() failed, passing a resource with a NULL dev pointer and triggering the WARN_ON assertion in res_to_rt().

Leer descripción completaMostrar menos

Fix this by only adding the resource to restrack when acquiring the device succeeds.

Detalles técnicos trazas, registros y código del informe original
"
WARNING: drivers/infiniband/core/restrack.c:138 at res_to_rt+0x1c4/0x230
CPU#1: kworker/u8:4/59
Modules linked in:
CPU: 1 UID: 0 PID: 59 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Compute Engine, BIOS Google 07/24/2026
Workqueue: ib_addr process_one_req
RIP: 0010:res_to_rt+0x1c4/0x230 drivers/infiniband/core/restrack.c:138
RSP: 0018:ffffc9000201f850 EFLAGS: 00010293
RAX: ffffffff88d00ce5 RBX: ffff88807f0fd4f8 RCX: ffff88801e6e0000
RDX: 0000000000000000 RSI: ffffffff8fd996f0 RDI: 0000000000000003
RBP: 0000000000000000 R08: ffff88801e6e0000 R09: 000000000000000a
R10: 0000000000000009 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff1100fe1fa9f R14: 0000000000000000 R15: 0000000000000003
FS:  0000000000000000(0000) GS:ffff888125012000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00001d559c3d2000 CR3: 0000000077c4c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rdma_restrack_add+0x5a/0x8a0 drivers/infiniband/core/restrack.c:236
 addr_handler+0x41a/0x5a0 drivers/infiniband/core/cma.c:3534
 process_one_req+0x2eb/0x540 drivers/infiniband/core/addr.c:624
 process_one_work kernel/workqueue.c:3375 [inline]
 process_scheduled_works+0xc4e/0x1630 kernel/workqueue.c:3458
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3539
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
"

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90218",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c5ebaca402f5c5bd61ac8316feb2aa3a0be4d4a8",
              "lessThan": "1d7e55ea64dd15769318ba2e0fe0956db82ba3c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa",
              "lessThan": "39e83bb77fc92344cd62a373b311f096d812e548",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa",
              "lessThan": "9c80273d663959504957606b9a24fe901ee2a4a1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa",
              "lessThan": "2a63cb9ea862ac7d947952b497eef6520853538c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa",
              "lessThan": "f72957e0b31f2962f4c1089a9223f1206aa26983",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa",
              "lessThan": "544e40805dbb6cfe64916bd4c8b238fec585ac2a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa",
              "lessThan": "64a2bd4cfc16c24f0a0e6321a2fd00ffde3e0a5b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa",
              "lessThan": "c6d1ec4fbe56492bb88987d577f04a5fb6955f26",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "073fdf539d4c022162db3d77a5afca1710f0de2d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fa37a461bd6d9ee86e891ba3e4074a450e44c881",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.10.37",
              "lessThan": "5.10.270",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.11.21",
              "lessThan": "5.12",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.12.4",
              "lessThan": "5.13",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/infiniband/core/cma.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.13",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/infiniband/core/cma.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:17.137",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1d7e55ea64dd15769318ba2e0fe0956db82ba3c3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2a63cb9ea862ac7d947952b497eef6520853538c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/39e83bb77fc92344cd62a373b311f096d812e548",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/544e40805dbb6cfe64916bd4c8b238fec585ac2a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/64a2bd4cfc16c24f0a0e6321a2fd00ffde3e0a5b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9c80273d663959504957606b9a24fe901ee2a4a1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c6d1ec4fbe56492bb88987d577f04a5fb6955f26",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f72957e0b31f2962f4c1089a9223f1206aa26983",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix WARNING in res_to_rt\n\nsyzbot reported a WARN_ON(!res->dev) in res_to_rt() triggered via\naddr_handler() during asynchronous address resolution:\n\n\"\nWARNING: drivers/infiniband/core/restrack.c:138 at res_to_rt+0x1c4/0x230\nCPU#1: kworker/u8:4/59\nModules linked in:\nCPU: 1 UID: 0 PID: 59 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Compute Engine, BIOS Google 07/24/2026\nWorkqueue: ib_addr process_one_req\nRIP: 0010:res_to_rt+0x1c4/0x230 drivers/infiniband/core/restrack.c:138\nRSP: 0018:ffffc9000201f850 EFLAGS: 00010293\nRAX: ffffffff88d00ce5 RBX: ffff88807f0fd4f8 RCX: ffff88801e6e0000\nRDX: 0000000000000000 RSI: ffffffff8fd996f0 RDI: 0000000000000003\nRBP: 0000000000000000 R08: ffff88801e6e0000 R09: 000000000000000a\nR10: 0000000000000009 R11: 0000000000000000 R12: dffffc0000000000\nR13: 1ffff1100fe1fa9f R14: 0000000000000000 R15: 0000000000000003\nFS:  0000000000000000(0000) GS:ffff888125012000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00001d559c3d2000 CR3: 0000000077c4c000 CR4: 00000000003526f0\nCall Trace:\n <TASK>\n rdma_restrack_add+0x5a/0x8a0 drivers/infiniband/core/restrack.c:236\n addr_handler+0x41a/0x5a0 drivers/infiniband/core/cma.c:3534\n process_one_req+0x2eb/0x540 drivers/infiniband/core/addr.c:624\n process_one_work kernel/workqueue.c:3375 [inline]\n process_scheduled_works+0xc4e/0x1630 kernel/workqueue.c:3458\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3539\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>\n\"\n\nIn addr_handler(), cma_acquire_dev_by_src_ip() is called to populate\nid_priv->cma_dev and bind the associated ib_device to id_priv->id.device.\nIf cma_acquire_dev_by_src_ip() returns an error (non-zero status), the ID\nremains unassociated with any RDMA device.\n\nPreviously, rdma_restrack_add(&id_priv->res) was invoked unconditionally\neven when cma_acquire_dev_by_src_ip() failed, passing a resource with a\nNULL dev pointer and triggering the WARN_ON assertion in res_to_rt().\n\nFix this by only adding the resource to restrack when acquiring the device\nsucceeds."
    }
  ],
  "lastModified": "2026-09-17T17:17:17.137",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}