CVE-2026-92495
- Source
- https://cve.org/CVERecord?id=CVE-2026-92495
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92495.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-92495
- Downstream
- Published
- 2026-09-17T16:10:10Z
- Modified
- 2026-09-18T03:48:40Z
- Summary
- RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time.
Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92495.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0afbfe019c881483337d9f8304e678af05ebe7cc
- https://git.kernel.org/stable/c/13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4
- https://git.kernel.org/stable/c/518df61b9b0a5b288dfa72c87246045329c18b8c
- https://git.kernel.org/stable/c/5361fb1e5bc246f9a2c0721543f72c8dac200769
- https://git.kernel.org/stable/c/9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92495.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-92495
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedea222485788208cd79bad42d25aae9232b33a934Fixed5361fb1e5bc246f9a2c0721543f72c8dac200769Fixed13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4Fixed0afbfe019c881483337d9f8304e678af05ebe7ccFixed518df61b9b0a5b288dfa72c87246045329c18b8cFixed9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16