7.8

CVE-2026-74378

RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue
buffer, which is mapped into userspace. It validates num_sge against
max_sge, but then re-reads the same field to calculate the memcpy
size. A concurrent userspace thread can modify num_sge between
validation and use, causing a heap buffer overflow when copying the
WQE into qp->resp.srq_wqe.

Read num_sge into a local variable and use it for both the bounds
check and the size calculation.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 8700e3e7c4857d28ebaa824509934556da0b3e76
Version < 3cfa2a3adc51b7c57729961a03446962ff10e3d2
Status affected
Version 8700e3e7c4857d28ebaa824509934556da0b3e76
Version < cd19a6345e3727adafafa5954b58b13c92e13b80
Status affected
Version 8700e3e7c4857d28ebaa824509934556da0b3e76
Version < 3e07ea9579dc9553d2285c26c2823931358aa3b8
Status affected
Version 8700e3e7c4857d28ebaa824509934556da0b3e76
Version < 02558c86b6b761063e9399e6b939984500327ef1
Status affected
Version 8700e3e7c4857d28ebaa824509934556da0b3e76
Version < b9800d7953d119bcc068c74587d48e4ba0313629
Status affected
Version 8700e3e7c4857d28ebaa824509934556da0b3e76
Version < 22b8fbded65b8c441b634a185f8da67657df6c50
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.8
Status affected
Version 0
Version < 4.8
Status unaffected
Version <= 6.1.*
Version 6.1.178
Status unaffected
Version <= 6.6.*
Version 6.6.145
Status unaffected
Version <= 6.12.*
Version 6.12.97
Status unaffected
Version <= 6.18.*
Version 6.18.40
Status unaffected
Version <= 7.1.*
Version 7.1.5
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.04
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/3cfa2a3adc51b7c57729961a03446962ff10e3d2
https://git.kernel.org/stable/c/cd19a6345e3727adafafa5954b58b13c92e13b80
https://git.kernel.org/stable/c/3e07ea9579dc9553d2285c26c2823931358aa3b8
https://git.kernel.org/stable/c/02558c86b6b761063e9399e6b939984500327ef1
https://git.kernel.org/stable/c/b9800d7953d119bcc068c74587d48e4ba0313629
https://git.kernel.org/stable/c/22b8fbded65b8c441b634a185f8da67657df6c50