CVE-2026-80880: Linux Kernel Race Condition Vulnerability

CVE-2026-80880 Overview

CVE-2026-80880 is a Linux kernel vulnerability in the Mellanox mlx5 InfiniBand (IB) driver. The issue affects the implicit On-Demand Paging (ODP) memory region re-registration path (rereg_mr). The parent memory key (mkey) in an implicit ODP configuration cannot be modified in place because child mkeys reference it. Additionally, implicit children touched the mr->pd field, creating a racy access pattern. The upstream fix rebuilds the memory region entirely on any change and forces implicit values when no translation is specified, routing through mlx5_ib_reg_user_mr() to allocate a new MR.

Critical Impact
Improper handling of parent and child mkeys in implicit ODP rereg_mr operations can lead to racy access to memory region state on systems using Mellanox ConnectX RDMA hardware.

Affected Products

Linux kernel IB/mlx5 driver (Mellanox ConnectX InfiniBand/RoCE)
Kernel builds with CONFIG_INFINIBAND_ON_DEMAND_PAGING enabled
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80880 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80880

Vulnerability Analysis

The IB/mlx5 driver implements RDMA memory region management for Mellanox ConnectX adapters. Implicit ODP allows the hardware to page in user memory on demand rather than pinning it. In this model, a parent mkey represents the address space while child mkeys represent individual pages or ranges.

When a user calls ib_rereg_mr to change attributes of a memory region, the previous implementation attempted to modify the parent mkey in place. Because live child mkeys reference the parent, in-place mutation leaves the driver in an inconsistent state. Concurrent access to mr->pd from child paths compounds the problem with a race window.

The upstream resolution rebuilds the entire MR on any rereg_mr request. When the caller does not supply a translation, the driver forces implicit values so control falls through to mlx5_ib_reg_user_mr(), which allocates a fresh MR. This removes the mutation path and closes the race on mr->pd.

Root Cause

The root cause is an unsafe in-place update of a parent object that owns dependent children, combined with concurrent access to shared state (mr->pd) without proper synchronization. This falls under Race Condition and Improper Access Control patterns in kernel resource management.

Attack Vector

Exploitation requires local access to an RDMA-capable device node such as /dev/infiniband/uverbs* and permissions to issue IBV_CMD_REREG_MR verbs against an implicit ODP MR. NVD has not published a CVSS vector for this CVE. No public proof-of-concept or in-the-wild exploitation has been reported.

Refer to the upstream commits for technical detail:

Detection Methods for CVE-2026-80880

Indicators of Compromise

No public IOCs are associated with CVE-2026-80880 at this time.
Kernel warnings or oops messages referencing mlx5_ib_rereg_user_mr, implicit_get_child_mr, or ODP paging code should be treated as suspicious.
Unexpected RDMA connection resets or MR invalidation events on hosts running the affected driver.

Detection Strategies

Inventory Linux hosts running the mlx5_ib module with lsmod | grep mlx5_ib and correlate kernel versions against the fixed stable releases.
Monitor dmesg and /var/log/kern.log for stack traces originating in the drivers/infiniband/hw/mlx5/ code path.
Audit which local users and containers can access /dev/infiniband/* device nodes and issue user verbs.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM tier for correlation across the fleet.
Alert on new processes opening uverbs devices outside of expected RDMA workloads (for example, HPC schedulers, NVMe-oF initiators, or storage services).
Track kernel package versions in configuration management and flag hosts that drift from the patched baseline.

How to Mitigate CVE-2026-80880

Immediate Actions Required

Identify all hosts running affected mlx5_ib kernels, including HPC clusters, AI/ML training nodes, and RDMA-backed storage systems.
Apply the vendor kernel update from your Linux distribution that incorporates the upstream fix commits.
Restrict access to /dev/infiniband/* device nodes to trusted service accounts and workloads only.

Patch Information

The fix is available in the upstream Linux stable tree via the following commits. Apply the distribution kernel that backports these changes:

Workarounds

If patching is not immediately possible and ODP is not required, disable On-Demand Paging by rebuilding without CONFIG_INFINIBAND_ON_DEMAND_PAGING or by not opting into ODP at the application level.
Unload the mlx5_ib module on hosts that do not require RDMA functionality with modprobe -r mlx5_ib.
Enforce strict permissions on /dev/infiniband/uverbs* so only vetted RDMA workloads can issue user verbs.

bash

# Verify running kernel and mlx5_ib module
uname -r
modinfo mlx5_ib | grep -E '^(filename|version|srcversion)'

# Restrict access to InfiniBand user verbs device nodes
ls -l /dev/infiniband/
chgrp rdma /dev/infiniband/uverbs*
chmod 660 /dev/infiniband/uverbs*