CVE-2026-74394
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, in the RDMA/srpt driver, the immediate data length check did not check for integer overflow, allowing a malicious initiator to bypass bounds check and pass ~4GB length to sg_init_one(). The fix uses check_add_overflow().
Risk Assessment
The vulnerability may lead to system crash or potentially remote code execution in kernel context.
Recommendation
Apply the Linux kernel update containing the fix for CVE-2026-74394.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison.