CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

The irdma_copy_user_pgaddrs function loops through all of the umem DMA
blocks to populate the PBLEs and will stop when either the last DMA
block is reached or palloc->total_cnt is reached. The issue is that
the logic for checking palloc->total_cnt would only work for non-zero
values.

When irdma_setup_pbles is called with lvl==0, it
calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means
the only way to break out of the loop is to reach the last umem DMA
block, which means it could end up going beyond the fixed size of 4
iwmr->pgaddrmem array that is used in the lvl==0 case.

In the case of QP/CQ/SRQ rings, the value of lvl is determined by a
separate input (for example, req.cq_pages in the case of a CQ). So,
we must perform explicit checking to ensure we don't overflow the
pgaddrmem array if the user provides a umem that consists of more
blocks than their provided req.cq_pages.

The Linux kernel CVE team has assigned CVE-2026-74390 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit b48c24c2d710cf34810c555dcef883a3d35a9c08 and fixed in 5.15.212 with commit 4780f58672ee6328accd54a95f9c00683477e499
	Issue introduced in 5.14 with commit b48c24c2d710cf34810c555dcef883a3d35a9c08 and fixed in 6.1.178 with commit 79a20a8e201a779224b4bf115250a7713bde72c0
	Issue introduced in 5.14 with commit b48c24c2d710cf34810c555dcef883a3d35a9c08 and fixed in 6.6.145 with commit 9f8f0d2099e3de1194e37dc933ae0c4206b09aaf
	Issue introduced in 5.14 with commit b48c24c2d710cf34810c555dcef883a3d35a9c08 and fixed in 6.12.97 with commit 192a3be0e3759daa24af2841208b074ca6dbaabc
	Issue introduced in 5.14 with commit b48c24c2d710cf34810c555dcef883a3d35a9c08 and fixed in 6.18.40 with commit 424d51d33c7541a86934067c2c0538124687fc90
	Issue introduced in 5.14 with commit b48c24c2d710cf34810c555dcef883a3d35a9c08 and fixed in 7.1.5 with commit abd27a977b419d584efa659488c22d2306987b29
	Issue introduced in 5.14 with commit b48c24c2d710cf34810c555dcef883a3d35a9c08 and fixed in 7.2-rc1 with commit 5ebb3ed757be3e04cf803026004aa0beaeb13e9b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74390
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/infiniband/hw/irdma/verbs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4780f58672ee6328accd54a95f9c00683477e499
	https://git.kernel.org/stable/c/79a20a8e201a779224b4bf115250a7713bde72c0
	https://git.kernel.org/stable/c/9f8f0d2099e3de1194e37dc933ae0c4206b09aaf
	https://git.kernel.org/stable/c/192a3be0e3759daa24af2841208b074ca6dbaabc
	https://git.kernel.org/stable/c/424d51d33c7541a86934067c2c0538124687fc90
	https://git.kernel.org/stable/c/abd27a977b419d584efa659488c22d2306987b29
	https://git.kernel.org/stable/c/5ebb3ed757be3e04cf803026004aa0beaeb13e9b