CVE-2026-45922 Overview
CVE-2026-45922 is a memory leak vulnerability in the Linux kernel's RDMA/mlx5 driver. The flaw resides in the UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function, which allocates memory for a device path using kobject_get_path(). When the device path length exceeds the output buffer, the function returns -ENOSPC without freeing the allocated buffer. Repeated invocations can exhaust kernel memory over time. The issue was identified through a prototype static analysis tool and code review, and the patch adds a kfree() call on the error path.
Critical Impact
Repeated triggering of the affected handler leaks kernel memory, potentially leading to resource exhaustion on systems using Mellanox ConnectX RDMA hardware.
Affected Products
- Linux kernel RDMA subsystem (drivers/infiniband/hw/mlx5)
- Systems using Mellanox mlx5 InfiniBand/RoCE drivers
- Kernel versions prior to the commits referenced in the patch series
Discovery Timeline
- 2026-05-27 - CVE-2026-45922 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45922
Vulnerability Analysis
The vulnerability is a kernel memory leak [CWE-401] inside the user-verbs (uverbs) handler for MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH. The handler exposes the sysfs path of the data-direct device to user space through the RDMA verbs interface. To do so, it calls kobject_get_path(), which allocates a kernel buffer holding the resolved path string.
After allocation, the handler compares the path length against the caller-supplied output buffer size. When the path does not fit, the function returns -ENOSPC and exits the error path. The original code missed releasing the buffer returned by kobject_get_path(), leaving the allocation orphaned in kernel memory.
An unprivileged user with access to an mlx5 RDMA device file can repeatedly invoke the handler with an undersized output buffer. Each call leaks one allocation, and sustained calls degrade system stability through gradual kernel memory exhaustion.
Root Cause
The root cause is missing cleanup on a partial error path. kobject_get_path() returns a heap-allocated string that the caller owns and must release with kfree(). The handler returned an error code before reaching the success path that freed the buffer, so the allocation was never reclaimed.
Attack Vector
The attack vector is local. A process holding a file descriptor to an mlx5 RDMA device can invoke the affected uverbs method with an intentionally small output buffer to trigger the -ENOSPC branch on every call. The vulnerability does not yield code execution or information disclosure on its own. The impact is limited to denial of service through kernel memory consumption. The fix adds a kfree() call to the error path before returning. Patch details are available in the upstream commits: Kernel Git Commit 9b9d253, Kernel Git Commit b2bc649, Kernel Git Commit b3a10ec, and Kernel Git Commit ee998cd.
No public proof-of-concept code is available. The issue was found through static analysis and the patch was compile-tested only.
Detection Methods for CVE-2026-45922
Indicators of Compromise
- Gradual, unexplained growth in kmalloc-* slab caches on hosts with mlx5 RDMA hardware
- Repeated -ENOSPC returns from uverbs ioctl calls against mlx5 devices in audit logs
- Increasing kernel slab allocations correlated with workloads that enumerate RDMA device sysfs paths
Detection Strategies
- Monitor /proc/slabinfo and /proc/meminfo for sustained growth in kernel allocations on RDMA-capable hosts
- Use kmemleak on test systems to identify unreferenced allocations originating from kobject_get_path()
- Audit calls to RDMA uverbs ioctls via auditd or eBPF tracing on ib_uverbs device files
Monitoring Recommendations
- Track kernel version inventory against the fixed commits across all hosts using Mellanox NICs
- Baseline RDMA uverbs ioctl frequency per process and alert on unusual repetition patterns
- Correlate slab cache growth with process-level activity to identify abusive callers
How to Mitigate CVE-2026-45922
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the commits 9b9d253, b2bc649, b3a10ec, and ee998cd
- Identify all hosts running mlx5-based RDMA hardware and prioritize them for kernel updates
- Restrict access to /dev/infiniband/uverbs* device nodes to trusted users and services
Patch Information
The fix adds a kfree() call on the error path of the UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function so the buffer returned by kobject_get_path() is released when the output buffer is too small. Distribution kernel teams have backported the change through the stable tree. Refer to the upstream commits for the exact diff and consult your distribution's security tracker for backported package versions.
Workarounds
- Limit access to RDMA uverbs device files using filesystem permissions or namespaces where RDMA is not required
- Unload the mlx5_ib module on systems that do not need RDMA functionality
- Apply container and workload isolation to prevent untrusted code from issuing uverbs ioctls
# Restrict access to RDMA uverbs device files until the kernel is patched
sudo chmod 600 /dev/infiniband/uverbs*
sudo chown root:root /dev/infiniband/uverbs*
# Optionally unload mlx5_ib on hosts that do not require RDMA
sudo modprobe -r mlx5_ib
echo 'blacklist mlx5_ib' | sudo tee /etc/modprobe.d/blacklist-mlx5_ib.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
