{"id":"CVE-2026-74377","state":"PUBLISHED","title":"RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Copy WQE to local buffer in non-SRQ receive path\n\nFor non-SRQ QPs, the responder reads WQE fields directly from the\nshared queue buffer mapped into userspace. This allows a malicious\nuser to modify fields like num_sge or sge entries while the kernel\nis processing the WQE, leading to out-of-bounds reads in\nrxe_resp_check_length() and copy_data().\n\nIntroduce get_recv_wqe() that validates num_sge and copies the WQE\nto a kernel-local buffer before processing, matching the approach\nalready used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is\nreused since SRQ and non-SRQ paths are mutually exclusive per QP.","publishedAt":"2026-08-15T05:58:55.704Z","updatedAt":"2026-10-16T18:55:36.323Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"2e60378fb3c8b51c94103bb40014c4fe38fa5033","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"9fa785137303f7109c23dea779b8dedc67c9b531","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"5420eebf3b3c162bfaf965f30e61cd1d689e5732","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"d6ab440240a04b8737ee4c7bb21af9182e451733","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.8","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"]}],"references":["https://git.kernel.org/stable/c/2e60378fb3c8b51c94103bb40014c4fe38fa5033","https://git.kernel.org/stable/c/fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78","https://git.kernel.org/stable/c/9fa785137303f7109c23dea779b8dedc67c9b531","https://git.kernel.org/stable/c/5420eebf3b3c162bfaf965f30e61cd1d689e5732","https://git.kernel.org/stable/c/a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b","https://git.kernel.org/stable/c/d6ab440240a04b8737ee4c7bb21af9182e451733"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74377.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74377","state":"PUBLISHED","datePublished":"2026-08-15T05:58:55.704Z","dateUpdated":"2026-10-16T18:55:36.323Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.889Z"},"containers":{"cna":{"title":"RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Copy WQE to local buffer in non-SRQ receive path\n\nFor non-SRQ QPs, the responder reads WQE fields directly from the\nshared queue buffer mapped into userspace. This allows a malicious\nuser to modify fields like num_sge or sge entries while the kernel\nis processing the WQE, leading to out-of-bounds reads in\nrxe_resp_check_length() and copy_data().\n\nIntroduce get_recv_wqe() that validates num_sge and copies the WQE\nto a kernel-local buffer before processing, matching the approach\nalready used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is\nreused since SRQ and non-SRQ paths are mutually exclusive per QP."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"2e60378fb3c8b51c94103bb40014c4fe38fa5033","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"9fa785137303f7109c23dea779b8dedc67c9b531","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"5420eebf3b3c162bfaf965f30e61cd1d689e5732","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","status":"affected","lessThan":"d6ab440240a04b8737ee4c7bb21af9182e451733","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.8","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2e60378fb3c8b51c94103bb40014c4fe38fa5033"},{"url":"https://git.kernel.org/stable/c/fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78"},{"url":"https://git.kernel.org/stable/c/9fa785137303f7109c23dea779b8dedc67c9b531"},{"url":"https://git.kernel.org/stable/c/5420eebf3b3c162bfaf965f30e61cd1d689e5732"},{"url":"https://git.kernel.org/stable/c/a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b"},{"url":"https://git.kernel.org/stable/c/d6ab440240a04b8737ee4c7bb21af9182e451733"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires mutating mmap'd receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv→rxe_rcv→rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU—userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic—so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker's own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:46:29.745Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74377","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:54:49.610673Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:55:36.323Z"}}]}}}