CVE-2026-45856: Linux Kernel Information Disclosure Bug

CVE-2026-45856 Overview

CVE-2026-45856 is an out-of-bounds read vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) user verbs subsystem. The flaw resides in the ib_uverbs_post_send() function, which accepts a cmd.wqe_size value from userspace without validation before passing it to kmalloc(). When a user provides an undersized wqe_size value, the kernel allocates a buffer too small to hold a struct ib_uverbs_send_wr, and subsequent field accesses read beyond the allocation boundary into adjacent kernel heap memory. Attackers can use this to leak sensitive kernel data to userspace. Excessively large wqe_size values can additionally trigger a memory allocator WARNING, as reported by syzkaller.

Critical Impact
Local userspace processes with access to RDMA uverbs devices can read out-of-bounds kernel heap memory, potentially leaking sensitive kernel information.

Affected Products

Linux kernel versions containing the unpatched ib_uverbs_post_send() implementation in drivers/infiniband/core/uverbs_cmd.c
Distributions shipping affected kernel branches with RDMA/InfiniBand uverbs support enabled
Systems exposing /dev/infiniband/uverbs* device nodes to unprivileged or container workloads

Discovery Timeline

2026-05-27 - CVE-2026-45856 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45856

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the RDMA user verbs interface exposed by the Linux kernel. The ib_uverbs_post_send() handler processes work queue entries (WQEs) submitted from userspace via the uverbs ABI. The function reads cmd.wqe_size directly from the userspace command and uses it as the allocation size for a buffer cast to struct ib_uverbs_send_wr.

Because no minimum size check is performed, a caller can request a buffer smaller than the structure itself. The kernel then dereferences fields such as user_wr->opcode, user_wr->num_sge, and others past the end of the allocation. Those reads return whatever data resides in the adjacent slab memory, which may include pointers, credentials, or other in-flight kernel data.

The sibling function ib_uverbs_unmarshall_recv() already enforces that wqe_size >= sizeof(struct ib_uverbs_recv_wr). The fix applies the same validation on the send path, rejecting requests where cmd.wqe_size is below the minimum structure size.

Root Cause

The root cause is missing input validation on a length field copied from userspace. The handler trusts cmd.wqe_size as both the allocation size and the implicit structure size, breaking the invariant that the buffer must be large enough to be reinterpreted as struct ib_uverbs_send_wr.

Attack Vector

Exploitation requires local access and the ability to open an RDMA uverbs character device. An attacker opens an InfiniBand or RoCE uverbs file descriptor, creates a queue pair, and issues an IB_USER_VERBS_CMD_POST_SEND command with wqe_size set to a value such as 1. The kernel allocates a 1-byte buffer, then reads further bytes as if they were a complete send work request, returning kernel heap contents that the attacker can observe through subsequent error paths or side channels. Submitting a very large wqe_size instead triggers an allocator warning, which can be used for denial of service or log flooding.

No verified public exploit code is available. Patch details are published in the upstream stable tree commits, including Kernel Git Commit bf4454da and Kernel Git Commit 9c15ec4c.

Detection Methods for CVE-2026-45856

Indicators of Compromise

Kernel log entries containing allocator WARNING messages originating from ib_uverbs_post_send call paths, consistent with the syzkaller-reported large-allocation trigger.
Unprivileged or container processes opening /dev/infiniband/uverbs* devices that have no legitimate RDMA workload.
Anomalous bursts of IB_USER_VERBS_CMD_POST_SEND ioctls issued from non-HPC, non-storage workloads.

Detection Strategies

Audit kernel versions against the fixed commits in the upstream stable tree and flag hosts running unpatched RDMA-enabled kernels.
Monitor dmesg and journal output for WARN_ON traces referencing __alloc_pages or kmalloc invoked from ib_uverbs_post_send.
Use eBPF or auditd rules to log openat() calls against /dev/infiniband/uverbs* and correlate with the invoking process and container identity.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log pipeline and alert on RDMA subsystem warnings.
Track per-process syscall patterns on hosts with InfiniBand or RoCE hardware to baseline expected uverbs usage.
Inventory which workloads actually require RDMA so that unexpected access to uverbs devices generates a high-confidence alert.

How to Mitigate CVE-2026-45856

Immediate Actions Required

Apply the upstream kernel patch that validates cmd.wqe_size >= sizeof(struct ib_uverbs_send_wr) in ib_uverbs_post_send().
Update to a distribution kernel that incorporates the fix from the stable commits listed in the references.
Restrict access to /dev/infiniband/uverbs* device nodes using filesystem permissions, cgroup device controllers, or container device allowlists.
On hosts without RDMA workloads, unload the ib_uverbs module or disable InfiniBand support in the kernel configuration.

Patch Information

The fix has been merged across multiple stable branches. Refer to the upstream commits for the canonical change: Kernel Git Commit bf4454da, Kernel Git Commit 01c9b152, Kernel Git Commit 1956f0a7, Kernel Git Commit 9b5ac1c1, Kernel Git Commit 9c15ec4c, Kernel Git Commit bef70ff9, Kernel Git Commit bf1feed1, and Kernel Git Commit d533425a. Track your distribution vendor's security tracker for backported package versions.

Workarounds

Blacklist the ib_uverbs and dependent InfiniBand modules on systems that do not require RDMA functionality.
Tighten permissions on /dev/infiniband/uverbs* so that only trusted service accounts can open the device.
In container environments, ensure RDMA device passthrough is explicitly denied unless required, for example by removing /dev/infiniband from container device allowlists.

bash

# Example: disable the uverbs module on hosts without RDMA workloads
echo 'blacklist ib_uverbs' | sudo tee /etc/modprobe.d/disable-ib-uverbs.conf
sudo rmmod ib_uverbs 2>/dev/null || true

# Example: restrict device access to a dedicated rdma group
sudo groupadd -f rdma
sudo chgrp rdma /dev/infiniband/uverbs*
sudo chmod 0660 /dev/infiniband/uverbs*