CVE-2026-52908
説明
A flaw was found in the Linux kernel. This vulnerability occurs during the re-registration of a Remote Direct Memory Access (RDMA) memory region. If the memory's access permissions are changed from read-only to read-write, the system may fail to properly update and secure the underlying user memory. This improper access control could allow unauthorized write operations to memory that should be protected.
詳細
RDMA rereg_mr could allow an existing user memory region to change from read only to writable access without rechecking that the underlying umem was pinned as writable. This can violate GUP and COW permission assumptions because the same pinned pages may later be exposed to writable RDMA access even though they were originally pinned read only. For the CVSS the PR:L is used because a local user or process with access to the RDMA uverbs device can request MR reregistration without full administrator privileges in many deployments. The issue is not directly network reachable because the vulnerable operation is a local RDMA control path operation. A remote RDMA peer may only become relevant after a local process exposes the MR and rkey. Impact is at least denial of service or memory corruption through unintended writes and may allow privilege escalation depending on the mapped memory and device configuration.
軽減策
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVSS (Common Vulnerability Scoring System) のスコアの詳細
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
以下の CSVV メトリクスおよびスコアは予備的で、再検討の対象となります。
CVSS v3 スコアの内訳
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| ベーススコア | 5.8 | N/A | 7.8 |
| 攻撃ベクトル | Local | N/A | Local |
| 攻撃の複雑さ | High | N/A | Low |
| 必要な権限 | Low | N/A | Low |
| ユーザー関与レベル | None | N/A | None |
| 範囲 | Unchanged | N/A | Unchanged |
| 機密性 | Low | N/A | High |
| 完全性への影響 | High | N/A | High |
| 可用性への影響 | Low | N/A | High |
ベクトル
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
脆弱性の原因 (CWE) の理解
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
An attacker could bypass intended access restrictions to read sensitive data, either by reading the data directly from a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
Integrity
Technical Impact: Modify Application Data; Modify Files or Directories
An attacker could bypass intended access restrictions to modify sensitive data, either by writing the data directly to a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
An attacker could bypass intended access restrictions to gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could use elevated privileges to execute unauthorized commands or code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An attacker could gain unauthorized access to resources on the system and excessively consume those resources, leading to a denial of service.
よくある質問
Not sure what something means? Check out our Security Glossary.
エラータ通知の受信を希望しますか? こちらで登録してください。
