{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74377","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.889Z","datePublished":"2026-08-15T05:58:55.704Z","dateUpdated":"2026-08-17T05:46:29.745Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:46:29.745Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Copy WQE to local buffer in non-SRQ receive path\n\nFor non-SRQ QPs, the responder reads WQE fields directly from the\nshared queue buffer mapped into userspace. This allows a malicious\nuser to modify fields like num_sge or sge entries while the kernel\nis processing the WQE, leading to out-of-bounds reads in\nrxe_resp_check_length() and copy_data().\n\nIntroduce get_recv_wqe() that validates num_sge and copies the WQE\nto a kernel-local buffer before processing, matching the approach\nalready used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is\nreused since SRQ and non-SRQ paths are mutually exclusive per QP."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires mutating mmap'd receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv→rxe_rcv→rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU—userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic—so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker's own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"],"versions":[{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"2e60378fb3c8b51c94103bb40014c4fe38fa5033","status":"affected","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78","status":"affected","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"9fa785137303f7109c23dea779b8dedc67c9b531","status":"affected","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"5420eebf3b3c162bfaf965f30e61cd1d689e5732","status":"affected","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b","status":"affected","versionType":"git"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"d6ab440240a04b8737ee4c7bb21af9182e451733","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"],"versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2e60378fb3c8b51c94103bb40014c4fe38fa5033"},{"url":"https://git.kernel.org/stable/c/fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78"},{"url":"https://git.kernel.org/stable/c/9fa785137303f7109c23dea779b8dedc67c9b531"},{"url":"https://git.kernel.org/stable/c/5420eebf3b3c162bfaf965f30e61cd1d689e5732"},{"url":"https://git.kernel.org/stable/c/a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b"},{"url":"https://git.kernel.org/stable/c/d6ab440240a04b8737ee4c7bb21af9182e451733"}],"title":"RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path","x_generator":{"engine":"bippy-1.2.0"}}}}