{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-74378", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.890Z", "datePublished": "2026-08-15T05:58:56.381Z", "dateUpdated": "2026-08-17T05:46:30.843Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:30.843Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe\n\nget_srq_wqe() reads wqe->dma.num_sge from the shared receive queue\nbuffer, which is mapped into userspace. It validates num_sge against\nmax_sge, but then re-reads the same field to calculate the memcpy\nsize. A concurrent userspace thread can modify num_sge between\nvalidation and use, causing a heap buffer overflow when copying the\nWQE into qp->resp.srq_wqe.\n\nRead num_sge into a local variable and use it for both the bounds\ncheck and the size calculation." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim's userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap'd SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap'd queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap'd SRQ ring buffer and overflows the fixed qp->resp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp->resp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/sw/rxe/rxe_resp.c" ], "versions": [ { "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "3cfa2a3adc51b7c57729961a03446962ff10e3d2", "status": "affected", "versionType": "git" }, { "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "cd19a6345e3727adafafa5954b58b13c92e13b80", "status": "affected", "versionType": "git" }, { "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "3e07ea9579dc9553d2285c26c2823931358aa3b8", "status": "affected", "versionType": "git" }, { "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "02558c86b6b761063e9399e6b939984500327ef1", "status": "affected", "versionType": "git" }, { "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "b9800d7953d119bcc068c74587d48e4ba0313629", "status": "affected", "versionType": "git" }, { "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "22b8fbded65b8c441b634a185f8da67657df6c50", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/sw/rxe/rxe_resp.c" ], "versions": [ { "version": "4.8", "status": "affected" }, { "version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.178" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3cfa2a3adc51b7c57729961a03446962ff10e3d2" }, { "url": "https://git.kernel.org/stable/c/cd19a6345e3727adafafa5954b58b13c92e13b80" }, { "url": "https://git.kernel.org/stable/c/3e07ea9579dc9553d2285c26c2823931358aa3b8" }, { "url": "https://git.kernel.org/stable/c/02558c86b6b761063e9399e6b939984500327ef1" }, { "url": "https://git.kernel.org/stable/c/b9800d7953d119bcc068c74587d48e4ba0313629" }, { "url": "https://git.kernel.org/stable/c/22b8fbded65b8c441b634a185f8da67657df6c50" } ], "title": "RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe", "x_generator": { "engine": "bippy-1.2.0" } } } }