CVE-2026-92495RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time. Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ea222485788208cd79bad42d25aae9232b33a934 before 5361fb1e5bc246f9a2c0721543f72c8dac200769; from ea222485788208cd79bad42d25aae9232b33a934 before 13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4; from ea222485788208cd79bad42d25aae9232b33a934 before 0afbfe019c881483337d9f8304e678af05ebe7cc; from ea222485788208cd79bad42d25aae9232b33a934 before 518df61b9b0a5b288dfa72c87246045329c18b8c; from ea222485788208cd79bad42d25aae9232b33a934 before 9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16 | CNA record |
References
- https://git.kernel.org/stable/c/5361fb1e5bc246f9a2c0721543f72c8dac200769
- https://git.kernel.org/stable/c/13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4
- https://git.kernel.org/stable/c/0afbfe019c881483337d9f8304e678af05ebe7cc
- https://git.kernel.org/stable/c/518df61b9b0a5b288dfa72c87246045329c18b8c
- https://git.kernel.org/stable/c/9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.