CVE-2026-23243
Published: 18 March 2026
Summary
CVE-2026-23243 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23243 is a vulnerability in the Linux kernel's RDMA/umad subsystem, specifically in the ib_umad_write function. The issue arises when computing data_len from a user-controlled count and MAD header sizes; a mismatch between the user-provided MAD header size and the RMPP header length can result in a negative data_len value. This negative value propagates to ib_create_send_mad(), causing the padding calculation to exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(), as evidenced by a KASAN slab-out-of-bounds report.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). By supplying crafted input to ib_umad_write, the attacker can trigger the out-of-bounds write, potentially leading to high-impact confidentiality, integrity, and availability violations, such as arbitrary kernel memory corruption or code execution.
The provided kernel patch references detail the mitigation: an explicit check has been added in ib_umad_write to reject negative data_len values before proceeding to create the send buffer. Security practitioners should apply the stable kernel commits (e.g., 1371ef6b1ecf, 205955f29c26, 362e45fd9069, 52ab82cc5cf8, 5551b02fdbfd) to affected Linux distributions supporting RDMA/umad.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12804
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can…
more
become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel OOB write in RDMA/umad directly enables privilege escalation via crafted ib_umad_write input leading to arbitrary kernel code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the core issue by requiring validation of user-controlled inputs like data_len computed from count and MAD/RMPP header sizes to reject invalid negative values before buffer operations.
Requires timely remediation of the specific kernel flaw via stable commits that add the explicit negative data_len check in ib_umad_write, preventing exploitation.
Kernel memory protection mechanisms mitigate the impact of the out-of-bounds memset in alloc_send_rmpp_list by protecting against unauthorized memory corruption from invalid data_len.