185 lines
8.4 KiB
JSON
185 lines
8.4 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-92495",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-16T12:21:13.871Z",
|
|
"datePublished": "2026-09-17T16:10:10.747Z",
|
|
"dateUpdated": "2026-10-19T09:04:01.510Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T09:04:01.510Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap\n\nbnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap\nflags, but a read-only mapping can still retain VM_MAYWRITE. nd later\nbe upgraded with mprotect(PROT_WRITE). This can bypass the write check\nthat only runs at mmap time.\n\nClear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page\nbranch, matching the existing policy that userspace writes are not\nexpected for these pages."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/infiniband/hw/bnxt_re/ib_verbs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "ea222485788208cd79bad42d25aae9232b33a934",
|
|
"lessThan": "5361fb1e5bc246f9a2c0721543f72c8dac200769",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ea222485788208cd79bad42d25aae9232b33a934",
|
|
"lessThan": "13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ea222485788208cd79bad42d25aae9232b33a934",
|
|
"lessThan": "0afbfe019c881483337d9f8304e678af05ebe7cc",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ea222485788208cd79bad42d25aae9232b33a934",
|
|
"lessThan": "518df61b9b0a5b288dfa72c87246045329c18b8c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ea222485788208cd79bad42d25aae9232b33a934",
|
|
"lessThan": "9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/infiniband/hw/bnxt_re/ib_verbs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.6",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.6",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.157",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.110",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.52",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.6",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "6.6.157"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "6.12.110"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "6.18.52"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "7.2.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5361fb1e5bc246f9a2c0721543f72c8dac200769"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0afbfe019c881483337d9f8304e678af05ebe7cc"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/518df61b9b0a5b288dfa72c87246045329c18b8c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16"
|
|
}
|
|
],
|
|
"title": "RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |