CVE-2026-74377
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the RDMA/rxe driver has been fixed for the non-SRQ receive path, where WQE fields were read directly from the shared queue buffer mapped into userspace. This allowed a malicious user to modify fields during processing, leading to out-of-bounds reads.
Risk Assessment
The vulnerability may be exploited locally to disclose data or cause a denial of service (DoS) via out-of-bounds reads.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix for CVE-2026-74377.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data(). Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP.