CVE-2026-74334

Received Received - Intake

RDMA/nldev Race Condition in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr->pd Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74334

EUVD

EUVD-2026-59481

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the RDMA subsystem when accessing memory region (mr) structures. The issue occurs because the protection domain (PD) associated with a memory region can change due to the rereg_mr operation, making concurrent accesses to mr->pd unsafe. The fix involves using mr->device instead of mr->pd->device and adding an rdma_restrack_sync() operation to ensure all old accesses are completed before new ones proceed.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA subsystem and involves race conditions in memory region (MR) handling. Detection requires checking kernel logs for RDMA-related errors or kernel panics. Commands like dmesg | grep -i rdma or journalctl -k | grep -i rdma may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could lead to memory corruption, crashes, or privilege escalation in systems using the Linux kernel's RDMA (Remote Direct Memory Access) functionality. Attackers might exploit the race condition to gain unauthorized access or disrupt system stability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a race condition in the Linux kernel's RDMA subsystem. Compliance impacts would depend on system-specific configurations and data processing activities rather than this technical flaw.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the RDMA subsystem if not in use. Monitor kernel logs for any signs of race conditions or crashes related to RDMA operations.

Hi! I’m here to help you understand CVE-2026-74334. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70