CVE-2026-74378

RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe.

Read num_sge into a local variable and use it for both the bounds check and the size calculation.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8700e3e7c4857d28ebaa824509934556da0b3e76 to before c8db0e5ab0b6c540214c46c56aaac7cbcb0967feAffected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before e48daa94ad2d406225b73491fc935064716f0ec7Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 3cfa2a3adc51b7c57729961a03446962ff10e3d2Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before cd19a6345e3727adafafa5954b58b13c92e13b80Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 3e07ea9579dc9553d2285c26c2823931358aa3b8Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 02558c86b6b761063e9399e6b939984500327ef1Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before b9800d7953d119bcc068c74587d48e4ba0313629Affected 8700e3e7c4857d28ebaa824509934556da0b3e76 to before 22b8fbded65b8c441b634a185f8da67657df6c50Affected
LinuxLinux	4.8Affected before 4.8Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

8700e3e7c4857d28ebaa824509934556da0b3e76 to before c8db0e5ab0b6c540214c46c56aaac7cbcb0967feAffected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before e48daa94ad2d406225b73491fc935064716f0ec7Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 3cfa2a3adc51b7c57729961a03446962ff10e3d2Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before cd19a6345e3727adafafa5954b58b13c92e13b80Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 3e07ea9579dc9553d2285c26c2823931358aa3b8Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 02558c86b6b761063e9399e6b939984500327ef1Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before b9800d7953d119bcc068c74587d48e4ba0313629Affected
8700e3e7c4857d28ebaa824509934556da0b3e76 to before 22b8fbded65b8c441b634a185f8da67657df6c50Affected

LinuxLinux

4.8Affected
before 4.8Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.