CVE-2026-74394

RDMA/srpt: fix integer overflow in immediate data length check

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: fix integer overflow in immediate data length check

imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one().

Use check_add_overflow() to detect wrapping before the comparison.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before c82c860f8c8e4f4f454c9f14d0ad0c0466965f7dAffected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 3efa5301137140a3ca3677a9098c0a93a0acfd49Affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 067b9556eeb007f28b7c2033b4dcde5b6d88418fAffected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before dcf7a986f377cce0749ed53f1d64195fbd5fdf91Affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 07dec3f6dcb6c6cc891162d252b800eb0e6d5e8eAffected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 65572fbd86033ae2370125593d59b8be34253aafAffected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 72497172a4799119a0282a5eb5e2b8ddcc821921Affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before eb4ecdf631fe00e8020bf461503cb9b7017ed796Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before c82c860f8c8e4f4f454c9f14d0ad0c0466965f7dAffected
5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 3efa5301137140a3ca3677a9098c0a93a0acfd49Affected
5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 067b9556eeb007f28b7c2033b4dcde5b6d88418fAffected
5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before dcf7a986f377cce0749ed53f1d64195fbd5fdf91Affected
5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 07dec3f6dcb6c6cc891162d252b800eb0e6d5e8eAffected
5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 65572fbd86033ae2370125593d59b8be34253aafAffected
5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before 72497172a4799119a0282a5eb5e2b8ddcc821921Affected
5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 to before eb4ecdf631fe00e8020bf461503cb9b7017ed796Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.