CVE-2026-90435

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow occurs in the RDMA/mlx5 component when the set user buf size() function calculates the Queue Pair (QP) buffer size. The function performs a left-shift operation on user-supplied rq.wqe cnt and rq.wqe shift values as signed integers. A sufficiently large rq.wqe cnt can lead to a signed integer overflow, resulting in a small or negative buf size. This causes the ib umem get() function to map a buffer smaller than the size the hardware will actually write into. Additionally, a similar shift operation used to compute qp->sq.offset in the create user qp() function is also affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.