« Back to list

CVE-2026-93037

Status: ReceivedHigh (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hfi1: Propagate sdma_txinit_ahg() errors

set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg().

If sdma_txinit_ahg() fails, it returns before initializing tx->txreq. However, set_txreq_header_ahg() ignores the error and returns the AHG change count, causing the caller to continue processing the request as though initialization had succeeded.

Propagate sdma_txinit_ahg() failures to the caller and abort request processing when initialization fails.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vulnerabilidad local en kernel Linux (AV:L/PR:L) que ignora fallos de inicialización en RDMA/hfi1, permitiendo escalar privilegios o causar corrupción de datos en operaciones de red infiniband sin propagación de errores.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageFilter Network TrafficExecution PreventionEncrypt Sensitive Information

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux KernelAI

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-93037",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
              "lessThan": "cb73c2fe6e9cf563c99f22b7c8bca0d5f70d603e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
              "lessThan": "122a730675565ff2ad210537c3fc3afb8291d482",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
              "lessThan": "bf974994150cfd14bfc599748925f4d426e00d90",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
              "lessThan": "fd6dee13f3857259b6b2ddd28e1ed95fd94ae2f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
              "lessThan": "5b7cefffd15d87c8103865f887cdcf9077d8094b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
              "lessThan": "3416db552eb378e54cb2f2ce0db5f0df88654bda",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
              "lessThan": "ca99431820e8cac19f6a091c04da54cbe8d64f52",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
              "lessThan": "091c6162c022cbdfb64219708a71728cfd1d4600",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/infiniband/hw/hfi1/user_sdma.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/infiniband/hw/hfi1/user_sdma.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:56.750",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/091c6162c022cbdfb64219708a71728cfd1d4600",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/122a730675565ff2ad210537c3fc3afb8291d482",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3416db552eb378e54cb2f2ce0db5f0df88654bda",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5b7cefffd15d87c8103865f887cdcf9077d8094b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bf974994150cfd14bfc599748925f4d426e00d90",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ca99431820e8cac19f6a091c04da54cbe8d64f52",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cb73c2fe6e9cf563c99f22b7c8bca0d5f70d603e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd6dee13f3857259b6b2ddd28e1ed95fd94ae2f9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Propagate sdma_txinit_ahg() errors\n\nset_txreq_header_ahg() ignores the return value of sdma_txinit_ahg().\n\nIf sdma_txinit_ahg() fails, it returns before initializing tx->txreq.\nHowever, set_txreq_header_ahg() ignores the error and returns the AHG\nchange count, causing the caller to continue processing the request as\nthough initialization had succeeded.\n\nPropagate sdma_txinit_ahg() failures to the caller and abort request\nprocessing when initialization fails.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
    }
  ],
  "lastModified": "2026-09-18T18:18:18.580",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}