CVE-2026-31491: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31491 Overview

CVE-2026-31491 is an integer overflow vulnerability [CWE-190] in the Linux kernel's RDMA/irdma driver. The flaw resides in depth calculation functions for Send Queue (SQ), Receive Queue (RQ), and Shared Receive Queue (SRQ) sizing. A local user can pass U32_MAX as the queue size value, triggering integer overflow and truncation during depth calculations. The functions then incorrectly return success when boundary checks should have failed.

Critical Impact
A local authenticated attacker can trigger integer overflow in the irdma driver, causing kernel-level availability impact on systems using Intel Ethernet RDMA hardware.

Affected Products

Linux Kernel version 6.18
Linux Kernel 7.0 release candidates (rc1 through rc7)
Systems using the RDMA/irdma driver for Intel Ethernet RDMA devices

Discovery Timeline

2026-04-22 - CVE-2026-31491 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31491

Vulnerability Analysis

The vulnerability exists in the Intel RDMA driver (irdma) within the Linux kernel's InfiniBand subsystem. The driver exposes interfaces that accept user-supplied queue depth parameters for SQ, RQ, and SRQ structures. These depth values undergo arithmetic calculations to determine memory allocation requirements and queue boundaries.

When userspace passes U32_MAX (4,294,967,295) as a queue size, subsequent arithmetic operations on this 32-bit unsigned integer overflow and wrap around. The truncated result bypasses the boundary checks that should reject oversized requests. The functions then return a success status, allowing the operation to proceed with invalid queue parameters.

The upstream fix hardens the depth calculation functions by performing all arithmetic and boundary validation using u64 (64-bit unsigned) types. This prevents truncation during intermediate calculations and ensures oversized values are correctly rejected.

Root Cause

The root cause is improper integer width handling [CWE-190]. The original code performed depth calculations using 32-bit unsigned integers, where intermediate multiplication or addition with attacker-controlled values could exceed the 32-bit range. The arithmetic wraparound produced values within acceptable ranges, defeating the validation logic that depended on accurate computation.

Attack Vector

Exploitation requires local access with privileges to interact with the RDMA subsystem, typically through /dev/infiniband/ device nodes or the libibverbs userspace API. An attacker invokes queue creation operations (such as ibv_create_qp or ibv_create_srq) with the maximum 32-bit value for queue size parameters. The vulnerability manifests in kernel space when the irdma driver processes these parameters, producing kernel state corruption that impacts system availability.

The vulnerability mechanism is documented in the upstream kernel commits. See Linux Kernel Commit 3f08351d, Linux Kernel Commit cbd852f5, and Linux Kernel Commit e37afcb5 for the patches.

Detection Methods for CVE-2026-31491

Indicators of Compromise

Unexpected kernel warnings, oopses, or panics referencing irdma symbols in dmesg or /var/log/kern.log
Abnormal queue creation requests with extreme size parameters logged by RDMA subsystem auditing
Unprivileged processes invoking ibv_create_qp or ibv_create_srq with maximum uint32_t values

Detection Strategies

Audit kernel logs for irdma driver errors, queue allocation failures, or unexpected resource exhaustion
Monitor uname -r output across the fleet to identify hosts running Linux kernel 6.18 or 7.0 release candidates with the irdma driver loaded
Use lsmod | grep irdma to identify hosts where the vulnerable driver is loaded and reachable

Monitoring Recommendations

Track local user invocation of RDMA verbs APIs through eBPF or auditd rules on /dev/infiniband/* device access
Alert on repeated kernel taint events or RDMA queue creation failures from non-administrative accounts
Correlate process execution telemetry with kernel-level fault events to identify exploitation attempts

How to Mitigate CVE-2026-31491

Immediate Actions Required

Update to a Linux kernel build that includes commits 3f08351d, cbd852f5, or e37afcb5 from the stable kernel tree
If patching is not immediate, unload the irdma module on systems that do not require Intel RDMA functionality using modprobe -r irdma
Restrict access to /dev/infiniband/ device nodes to trusted users only through group permissions and udev rules

Patch Information

The vulnerability is resolved by three upstream commits that refactor depth calculation functions to use u64 arithmetic throughout. Apply the patches referenced in Linux Kernel Commit 3f08351d, Linux Kernel Commit cbd852f5, and Linux Kernel Commit e37afcb5. Distribution vendors will incorporate these fixes into their stable kernel releases.

Workarounds

Blacklist the irdma kernel module on systems that do not use Intel Ethernet RDMA hardware by adding blacklist irdma to /etc/modprobe.d/blacklist.conf
Apply mandatory access control policies (SELinux, AppArmor) to restrict which processes can open InfiniBand device nodes
Limit local user accounts and enforce least-privilege access on multi-tenant systems where RDMA hardware is exposed

bash

# Configuration example: disable irdma module if not required
echo "blacklist irdma" | sudo tee /etc/modprobe.d/disable-irdma.conf
sudo modprobe -r irdma
sudo update-initramfs -u