Riskcovery

CVE-2026-92495

RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 16, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time.

Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ea222485788208cd79bad42d25aae9232b33a934 to before 5361fb1e5bc246f9a2c0721543f72c8dac200769Affected
  • ea222485788208cd79bad42d25aae9232b33a934 to before 13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4Affected
  • ea222485788208cd79bad42d25aae9232b33a934 to before 0afbfe019c881483337d9f8304e678af05ebe7ccAffected
  • ea222485788208cd79bad42d25aae9232b33a934 to before 518df61b9b0a5b288dfa72c87246045329c18b8cAffected
  • ea222485788208cd79bad42d25aae9232b33a934 to before 9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16Affected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.