CVE-2026-92523

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are consumed directly with nla_get_u32(). The top-level policy validates only the container, so it does not establish the fixed shape of each child. Require every child payload to be exactly one u32 before reading it.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:55.283000

Last modified

2026-10-19 10:16:52.943000

View original CVE JSON

{
  "id": "CVE-2026-92523",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:55.283",
  "lastModified": "2026-10-19T10:16:52.943",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/nldev: validate dynamic counter attribute length\n\nRDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are\nconsumed directly with nla_get_u32(). The top-level policy validates only\nthe container, so it does not establish the fixed shape of each child.\n\nRequire every child payload to be exactly one u32 before reading it."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/infiniband/core/nldev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3c3c1f1416392382faa0238e76a70d7810aab2ef",
              "lessThan": "7828d68ae8cad3463e38def5c91668c84e722596",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c3c1f1416392382faa0238e76a70d7810aab2ef",
              "lessThan": "f8e9315236c8b5155158c6955a758e7960b143e6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c3c1f1416392382faa0238e76a70d7810aab2ef",
              "lessThan": "d00b0d808ca706a04bd198827319a4a287eff82a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c3c1f1416392382faa0238e76a70d7810aab2ef",
              "lessThan": "0bfa897e3e1a61d172f95675b353168bc9290312",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c3c1f1416392382faa0238e76a70d7810aab2ef",
              "lessThan": "c57e238b475e8e1e514499772b8c0db5768be93f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c3c1f1416392382faa0238e76a70d7810aab2ef",
              "lessThan": "74f49255492a62658f36bf2578d7916f1c6ffad1",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/infiniband/core/nldev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0bfa897e3e1a61d172f95675b353168bc9290312",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/74f49255492a62658f36bf2578d7916f1c6ffad1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7828d68ae8cad3463e38def5c91668c84e722596",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c57e238b475e8e1e514499772b8c0db5768be93f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d00b0d808ca706a04bd198827319a4a287eff82a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f8e9315236c8b5155158c6955a758e7960b143e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}