Description
In the Linux kernel, the following vulnerability has been resolved:

RDMA/efa: Fix PBL chunk length computation

On register MR, when creating the PBL, if it's an indirect PBL we create
a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size
and can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte
control buffer at the end of it holding the next chunk's pointer and its
length.

If the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the
calculated last chunk length is wrongly computed as 0, even though that
chunk is fully populated with 510 real page pointers. This wrong length
is used both to DMA map the chunk and is propagated to the device,
causing the device to see the chunk as empty and reject the memory
registration.

Fix the calculation so it will be performed only if the number of pages
isn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in
the above loop correctly.
Also prevent out-of-bounds reach in the chunks array in such scenario.
Published: 2026-09-24
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via RDMA memory registration failure
Action: Apply Patch
AI Analysis

Impact

In the Linux kernel’s RDMA/EFA component, a bug in the computation of the last PBL chunk length causes that chunk to be reported as empty when its page count is an exact multiple of 510 addresses. This miscalculation leads the device to reject memory registration for that chunk, while it was fully populated. The flaw does not provide code execution, elevation of privilege, or direct data disclosure, but it does interrupt RDMA operations, effectively denying service to applications relying on direct memory access. The weakness corresponds to incomplete validation of input parameters that influence memory mapping and potential buffer overflows. The impact is limited to the termination or failure of RDMA memory registration requests, which can disrupt performance‑critical workloads.

Affected Systems

The vulnerability affects Linux kernel distributions that include the Elastic Fabric Adapter (EFA) driver for Elastic Fabric Adapter hardware. Any kernel version before the commit that corrects the PBL chunk length computation is potentially affected. Because the effect is triggered during memory registration, systems where the EFA driver is enabled and RDMA operations are performed are at risk. Distributions that ship kernels containing the vulnerable code without later patching remain impacted until the change is incorporated.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% reflects a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed large‑scale exploits. Attackers are likely to exploit the flaw by initiating RDMA memory registrations; the vector is inferred to be local or remote with RDMA access, as the flaw is triggered by the device during the registration process. No public exploit is documented, but a local user with RDMA capabilities could repeatedly attempt registration to cause service disruption.

Generated by OpenCVE AI on October 1, 2026 at 23:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that incorporates the PBL chunk length fix
  • If an immediate kernel upgrade is not feasible, consider disabling the EFA driver by removing its module or setting related sysctl parameters to prevent EFA initialization
  • Monitor system logs and RDMA event counters for registration failures to detect impact

Generated by OpenCVE AI on October 1, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4817-1 linux-6.12 security update
Debian DLA Debian DLA DLA-4841-1 linux security update
Debian DSA Debian DSA DSA-6528-1 linux security update
Ubuntu USN Ubuntu USN USN-8961-1 Linux kernel vulnerabilities
History

Thu, 01 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-400

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Fri, 25 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-400

Thu, 24 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL, if it's an indirect PBL we create a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size and can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte control buffer at the end of it holding the next chunk's pointer and its length. If the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the calculated last chunk length is wrongly computed as 0, even though that chunk is fully populated with 510 real page pointers. This wrong length is used both to DMA map the chunk and is propagated to the device, causing the device to see the chunk as empty and reject the memory registration. Fix the calculation so it will be performed only if the number of pages isn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in the above loop correctly. Also prevent out-of-bounds reach in the chunks array in such scenario.
Title RDMA/efa: Fix PBL chunk length computation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:08:17.409Z

Reserved: 2026-09-17T16:02:15.097Z

Link: CVE-2026-93264

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T16:17:23.193

Modified: 2026-10-19T10:17:17.760

Link: CVE-2026-93264

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-93264 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T23:30:14Z

Weaknesses