In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap
flags, but a read-only mapping can still retain VM_MAYWRITE. nd later
be upgraded with mprotect(PROT_WRITE). This can bypass the write check
that only runs at mmap time.

Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page
branch, matching the existing policy that userspace writes are not
expected for these pages.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
ea222485788208cd79bad42d25aae9232b33a934 affected < 5361fb1e5bc246f9a2c0721543f72c8dac200769
ea222485788208cd79bad42d25aae9232b33a934 affected < 13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4
ea222485788208cd79bad42d25aae9232b33a934 affected < 0afbfe019c881483337d9f8304e678af05ebe7cc
ea222485788208cd79bad42d25aae9232b33a934 affected < 518df61b9b0a5b288dfa72c87246045329c18b8c
ea222485788208cd79bad42d25aae9232b33a934 affected < 9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16
Linux Linux affected
Version Status Constraints
6.6 affected —
0 unaffected < 6.6
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0afbfe019c881483337d9f8304e678af05ebe7cc cve-icon cve-icon
https://git.kernel.org/stable/c/13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4 cve-icon cve-icon
https://git.kernel.org/stable/c/518df61b9b0a5b288dfa72c87246045329c18b8c cve-icon cve-icon
https://git.kernel.org/stable/c/5361fb1e5bc246f9a2c0721543f72c8dac200769 cve-icon cve-icon
https://git.kernel.org/stable/c/9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16 cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time. Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
Title RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:10:10.747Z

Reserved: 2026-09-16T12:21:13.871Z

Link: CVE-2026-92495

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:51.670

Modified: 2026-09-17T17:17:51.670

Link: CVE-2026-92495

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.