CVE-2026-93264

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/efa: Fix PBL chunk length computation

On register MR, when creating the PBL, if it's an indirect PBL we create

a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size

and can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte

control buffer at the end of it holding the next chunk's pointer and its

length.

If the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the

calculated last chunk length is wrongly computed as 0, even though that

chunk is fully populated with 510 real page pointers. This wrong length

is used both to DMA map the chunk and is propagated to the device,

causing the device to see the chunk as empty and reject the memory

registration.

Fix the calculation so it will be performed only if the number of pages

isn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in

the above loop correctly.

Also prevent out-of-bounds reach in the chunks array in such sc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References