Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-74377

RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data(). Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 8700e3e7c4857d28ebaa824509934556da0b3e76 to < 2e60378fb3c8b51c94103bb40014c4fe38fa5033affected
  • 8700e3e7c4857d28ebaa824509934556da0b3e76 to < fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78affected
  • 8700e3e7c4857d28ebaa824509934556da0b3e76 to < 9fa785137303f7109c23dea779b8dedc67c9b531affected
  • 8700e3e7c4857d28ebaa824509934556da0b3e76 to < 5420eebf3b3c162bfaf965f30e61cd1d689e5732affected
  • 8700e3e7c4857d28ebaa824509934556da0b3e76 to < a211b7904aed365e4e4f08a48ec6e6dd1ea7b16baffected
  • 8700e3e7c4857d28ebaa824509934556da0b3e76 to < d6ab440240a04b8737ee4c7bb21af9182e451733affected

Linux Linux

Default version status: affected

  • 4.8affected
  • 0 to < 4.8unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References