CVE-2026-93264
Received Received - Intake

RDMA/efa PBL Chunk Length Calculation Vulnerability

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL, if it's an indirect PBL we create a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size and can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte control buffer at the end of it holding the next chunk's pointer and its length. If the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the calculated last chunk length is wrongly computed as 0, even though that chunk is fully populated with 510 real page pointers. This wrong length is used both to DMA map the chunk and is propagated to the device, causing the device to see the chunk as empty and reject the memory registration. Fix the calculation so it will be performed only if the number of pages isn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in the above loop correctly. Also prevent out-of-bounds reach in the chunks array in such scenario.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93264
EUVD
EUVD-2026-86136

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect calculation of the PBL chunk length during memory registration. When the number of pages is a multiple of the chunk size, the last chunk is wrongly marked as empty, causing the device to reject memory registration.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/efa driver and involves incorrect PBL chunk length computation during memory registration. Detection requires checking the kernel version and verifying if the affected driver is in use. Commands like 'uname -r' to check the kernel version and 'lsmod | grep efa' to check if the efa module is loaded may help identify exposure.

Impact Analysis

This vulnerability could lead to memory registration failures in systems using the RDMA/efa driver. It may cause applications relying on RDMA to crash or malfunction, potentially disrupting network communication and data transfer.

Compliance Impact

This vulnerability affects memory registration in the Linux kernel's RDMA/efa driver, potentially causing memory access issues. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory management.

Mitigation Strategies

Apply the kernel patch that fixes the PBL chunk length computation issue. Update to a patched kernel version where this vulnerability is resolved. If using a distribution kernel, check for updates from your vendor. Disable the efa driver if not needed via 'modprobe -r efa' until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart