CVE-2026-45856
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A vulnerability has been identified in the Linux kernel in the ib_uverbs_post_send() function, which does not validate the wqe_size value before use. This allows reading beyond the allocated buffer, potentially leaking sensitive kernel information.
Risk Assessment
This vulnerability poses a risk of leaking sensitive kernel information to userspace, which could be exploited by a malicious user for privilege escalation or other attacks.
Recommendation
It is recommended to update the Linux kernel to a version that includes a fix validating the wqe_size in the ib_uverbs_post_send() function.
Other vulnerabilities in Linux kernel
See all- CVE-2026-80886Unknown
In the Linux kernel, a vulnerability in the msm serial driver was fixed by disabling DMA for the console UART. Concurrent writes from userspace and the kernel can trigger a race condition resulting in an infinite loop of the same messages. The fix disables DMA for the console UART to ensure a reliable output path.
- CVE-2026-80885Unknown
In the Linux kernel, a fix was made for an uncancelled rxrpc OOB message handler in AFS. The fix cancels OOB message processing (typically to respond to security challenges) and moves it to afs_wq so it is also waited for. The OOB handler now returns if the net namespace is no longer live.
- CVE-2026-80884Unknown
In the Linux kernel, a fix was made in the NTB driver to store the original DMA address for future release. The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. The fix prevents modifying it.
- CVE-2026-80882Unknown
In the Linux kernel, a fix was made in the Tegra crypto driver to return ENOMEM when input buffer allocation fails for ccm. The fix ensures the ENOMEM error value is set when the allocation fails in tegra_ccm_do_one_req.
- CVE-2026-80881Unknown
In the Linux kernel, a fix was made in the OCFS2 filesystem regarding buffer head management in ocfs2_read_blocks(). The fix clarifies that the caller should not assume that the buffer head returned by sb_getblk() is exclusively owned and that put_bh() always drops b_count from 1 to 0. To avoid a scenario where a buffer head remains on hold and may be returned with BH_Uptodate set despite previous validation failure, BH_Uptodate is now cleared immediately after the validate() callback detects data inconsistency.
- CVE-2026-80880Unknown
In the Linux kernel, the IB/mlx5 driver has a vulnerability related to implicit ODP and rereg_mr operation. Due to child mkeys in the implicit ODP configuration, nothing can be changed in place for the parent mkey, so the whole structure must be rebuilt. Additionally, a race condition involving access to mr->pd by child keys was removed.
- CVE-2026-80879Unknown
A circular locking dependency was found in the Linux kernel's OCFS2 filesystem during direct I/O write completion. The ocfs2_dio_end_io_write function could deadlock due to improper lock ordering involving system inodes (INODE_ALLOC, EXTENT_ALLOC, ORPHAN_DIR). The fix releases allocation contexts before acquiring the ORPHAN_DIR lock.
- CVE-2026-80878Unknown
In the Linux kernel, the AFS filesystem has a memory leak related to an ungot volume. The afs_lookup_volume_rcu() function does not release a dying volume when afs_try_get_volume() fails.
- CVE-2026-80877Unknown
In the Linux kernel, the AFS filesystem has a memory leak related to the vllist in afs_update_cell(). When the new list is empty (nr_servers == 0), the old list is not replaced, leading to a leak of the new list.
- CVE-2026-80876Unknown
A vulnerability was found in the Linux kernel's ring buffer mechanism used by ftrace. When RB_FORCE_8BYTE_ALIGNMENT is enabled (e.g., on riscv64 with CONFIG_HAVE_64BIT_ALIGNED_ACCESS), ring_buffer_event_length() incorrectly calculates the length of small events, reporting a data length 4 bytes larger than expected. This causes inconsistent results in ftrace tests (trace_marker_raw).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).