CVE-2026-74297

RDMA/mlx5: Fix undefined shift of user RQ WQE size

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix undefined shift of user RQ WQE size

set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior.

Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before 9fff54929cc00849d738faa99f06c32399aeb026Affected e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before b746f949c2ac2b041102836095d6d4a2ef21fa75Affected e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before c1dbf52d24a8cb1aa56780ba51b72e7d495f258cAffected e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before 6fc874fdfb366bfb11c62e6af9a831c8be59dddaAffected e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before 42f3d2c8c18b92ea33e506a38b64f1a8986c2823Affected e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before 4b87a2497276a72fd63028e7419abf0fb7ed837bAffected e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before b732db02a2b04cde393638df19de6251ce62a74eAffected e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before d881d60223aac8fdc12b227d89c76e131e92a9cdAffected
LinuxLinux	3.11Affected before 3.11Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before 9fff54929cc00849d738faa99f06c32399aeb026Affected
e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before b746f949c2ac2b041102836095d6d4a2ef21fa75Affected
e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before c1dbf52d24a8cb1aa56780ba51b72e7d495f258cAffected
e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before 6fc874fdfb366bfb11c62e6af9a831c8be59dddaAffected
e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before 42f3d2c8c18b92ea33e506a38b64f1a8986c2823Affected
e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before 4b87a2497276a72fd63028e7419abf0fb7ed837bAffected
e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before b732db02a2b04cde393638df19de6251ce62a74eAffected
e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c to before d881d60223aac8fdc12b227d89c76e131e92a9cdAffected

LinuxLinux

3.11Affected
before 3.11Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.