CVE-2026-72494 (GCVE-0-2026-72494)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-09-21 13:13
VLAI
Title
RDMA/irdma: Replace waitqueue and flag with completion
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit request_done flag, but without proper barriers around request_done. An earlier patch by Gui-Dong Han <hanguidong02@gmail.com> attempted to fix this by adding the missing memory barriers. Rather than adding the barriers, this patch replaces the waitqueue+flag with a completion, which is designed for this exact purpose.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 44d9e52977a1b90b0db1c7f8b197c218e9226520 , < 706591cccdd3ac2c0ddc8c2ed6c89a6be9865826 (git)
Affected: 44d9e52977a1b90b0db1c7f8b197c218e9226520 , < bde37aed0724c0139dea177f3aae8d989b6babb1 (git)
Affected: 44d9e52977a1b90b0db1c7f8b197c218e9226520 , < d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/hw.c",
            "drivers/infiniband/hw/irdma/main.h",
            "drivers/infiniband/hw/irdma/utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "706591cccdd3ac2c0ddc8c2ed6c89a6be9865826",
              "status": "affected",
              "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
              "versionType": "git"
            },
            {
              "lessThan": "bde37aed0724c0139dea177f3aae8d989b6babb1",
              "status": "affected",
              "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
              "versionType": "git"
            },
            {
              "lessThan": "d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd",
              "status": "affected",
              "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/hw.c",
            "drivers/infiniband/hw/irdma/main.h",
            "drivers/infiniband/hw/irdma/utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Replace waitqueue and flag with completion\n\nThe driver previously used a waitqueue along with an explicit\nrequest_done flag, but without proper barriers around request_done.\n\nAn earlier patch by Gui-Dong Han \u003changuidong02@gmail.com\u003e attempted\nto fix this by adding the missing memory barriers. Rather than\nadding the barriers, this patch replaces the waitqueue+flag with\na completion, which is designed for this exact purpose."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Intel irdma CQP completion/wait synchronization is exercised from remote iWARP/RoCE connection management (SYN/listener/IEQ/AEQ) and deferred-completion events, not only local ibverbs; network peers drive the completion side of the race on internet-facing RDMA/NFS/SMB-Direct servers.\nAC:L - Attacker controls both sides by flooding concurrent connections/CQP ops remotely or via concurrent RDMA verbs locally; missing release/acquire ordering on request_done vs compl_info is triggerable at high operation rates without luck-dependent layout.\nPR:N - Remote CM and packet-processing paths issue/wait on CQP before MPA/application auth; local exploitation needs only standard unprivileged /dev/infiniband/uverbs* access (0666 under typical rdma-core udev rules), not init-namespace capabilities.\nUI:N - Exploitation needs only attacker-driven network or verbs traffic against an already-bound RDMA device/listener; no additional victim user action at attack time beyond normal server role.\nS:U - Impact stays within kernel/driver security domain (CQP request objects, NIC PF reset); no VM escape or cross-authority boundary.\nC:H - Without proper barriers the waiter can observe request_done before compl_info stores, return success with stale op_ret_val/error, and recycle the cqp_request while hardware still references scratch \u2192 UAF/read primitives.\nI:H - Premature recycle/double-put of dynamic cqp_requests enables attacker-influenced heap reuse; stale callbacks on reused objects and invalid kfree paths provide kernel write/control-flow corruption primitives.\nA:H - Lost request_done causes CQP timeout \u2192 ice_rdma_request_reset PF reset; wrong completion state can leave mod_qp_waitq in uninterruptible wait; UAF/panic paths cause kernel crash/hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:13:54.011Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/706591cccdd3ac2c0ddc8c2ed6c89a6be9865826"
        },
        {
          "url": "https://git.kernel.org/stable/c/bde37aed0724c0139dea177f3aae8d989b6babb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd"
        }
      ],
      "title": "RDMA/irdma: Replace waitqueue and flag with completion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72494",
    "datePublished": "2026-08-15T05:57:28.280Z",
    "dateReserved": "2026-08-09T03:40:39.937Z",
    "dateUpdated": "2026-09-21T13:13:54.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72494",
      "date": "2026-09-22",
      "epss": "0.00475",
      "percentile": "0.40203"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:46:30.000Z",
      "cve": "CVE-2026-72494",
      "id": "msrc_CVE-2026-72494",
      "initial_release_date": "2026-08-23T14:46:30.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/irdma: Replace waitqueue and flag with completion",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72494.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/irdma/hw.c",
                  "drivers/infiniband/hw/irdma/main.h",
                  "drivers/infiniband/hw/irdma/utils.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "706591cccdd3ac2c0ddc8c2ed6c89a6be9865826",
                    "status": "affected",
                    "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bde37aed0724c0139dea177f3aae8d989b6babb1",
                    "status": "affected",
                    "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd",
                    "status": "affected",
                    "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/irdma/hw.c",
                  "drivers/infiniband/hw/irdma/main.h",
                  "drivers/infiniband/hw/irdma/utils.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Replace waitqueue and flag with completion\n\nThe driver previously used a waitqueue along with an explicit\nrequest_done flag, but without proper barriers around request_done.\n\nAn earlier patch by Gui-Dong Han \u003changuidong02@gmail.com\u003e attempted\nto fix this by adding the missing memory barriers. Rather than\nadding the barriers, this patch replaces the waitqueue+flag with\na completion, which is designed for this exact purpose."
          }
        ],
        "id": "CVE-2026-72494",
        "lastModified": "2026-09-21T14:17:17.923",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:23.747",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/706591cccdd3ac2c0ddc8c2ed6c89a6be9865826"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bde37aed0724c0139dea177f3aae8d989b6babb1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-01T10:42:42+00:00",
      "cve": "CVE-2026-72494",
      "id": "CVE-2026-72494",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/irdma: Replace waitqueue and flag with completion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72494.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-22T16:37:38Z",
      "cve": "CVE-2026-72494",
      "id": "CVE-2026-72494",
      "initial_release_date": "2026-08-27T00:23:10Z",
      "product_status:first_fixed": "60",
      "product_status:known_affected": "576",
      "product_status:known_not_affected": "143",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72494",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72494.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.