CVE-2026-92495
Last modified
CVE-2026-92495 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE).
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time. Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= ea222485788208cd79bad42d25aae9232b33a934, < 5361fb1e5bc246f9a2c0721543f72c8dac200769; >= ea222485788208cd79bad42d25aae9232b33a934, < 13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4; >= ea222485788208cd79bad42d25aae9232b33a934, < 0afbfe019c881483337d9f8304e678af05ebe7cc; >= ea222485788208cd79bad42d25aae9232b33a934, < 518df61b9b0a5b288dfa72c87246045329c18b8c; >= ea222485788208cd79bad42d25aae9232b33a934, < 9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16 |
| Linux | Linux | 6.6 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-92495?
How severe is CVE-2026-92495?
How do I fix CVE-2026-92495?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9249Unverified password change in Devolutions Server allows an a…3.1
- CVE-2026-92490In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92491In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92492In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92493In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92494In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92496In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92497In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92498In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92499In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92500In the Linux kernel, the following vulnerability has been re…
- CVE-2026-92501In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2026-92495?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
