CVE-2026-74297

Received Received - Intake

RDMA/mlx5 Kernel Shift Overflow in WQE Size

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74297

EUVD

EUVD-2026-59444

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an undefined shift operation when computing the Receive Queue Work Queue Entry (RQ WQE) size in the RDMA/mlx5 driver. The function set_rq_size() calculates the size as 1 shifted left by rq_wqe_shift, but the input rq_wqe_shift is only checked to be greater than 32. A shift of 31 causes a signed integer overflow, leading to undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/mlx5 driver and does not have a direct network detection method. Check if your kernel version includes the vulnerable set_rq_size() function by inspecting kernel logs or running uname -a to verify the kernel version. If the kernel is vulnerable, look for RDMA/mlx5 related errors in dmesg or system logs.

Impact Analysis

This vulnerability could allow an attacker with local access to cause undefined behavior in the kernel, potentially leading to crashes, data corruption, or privilege escalation. Systems using affected Linux kernel versions with RDMA/mlx5 functionality may be at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a low-level kernel memory corruption issue in the Linux RDMA subsystem. Compliance impacts would depend on whether the vulnerability could lead to unauthorized data access or processing, which is not specified in the provided context.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If an update is not immediately available, disable the RDMA/mlx5 driver if not required. Monitor kernel security advisories and vendor patches for this CVE.

Hi! I’m here to help you understand CVE-2026-74297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70