CVE-2026-74346

Received Received - Intake

RDMA/irdma Out-of-Bounds Read in CQ Memory Registration

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74346

EUVD

EUVD-2026-59493

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an out-of-bounds (OOB) read during CQ (Completion Queue) Memory Region (MR) registration in the RDMA/irdma driver. The issue occurs because the cqmr->split field, which tracks the IRDMA_FEATURE_CQ_RESIZE flag, was not set properly during CQ memory registration. This caused the system to incorrectly populate cqmr->shadow for newer hardware generations, leading to an OOB read when accessing memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/irdma driver and involves an out-of-bounds (OOB) read during CQ MR registration. Detection requires checking the kernel version and the irdma driver for the affected code paths. No direct commands are provided in the context, but monitoring kernel logs for RDMA-related errors or OOB read warnings may help identify exploitation attempts.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory outside the intended bounds, potentially exposing confidential data or causing system instability. It specifically affects systems using the RDMA/irdma driver in the Linux kernel, which may lead to unauthorized access or denial-of-service conditions.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Exposure of sensitive information due to OOB reads may result in non-compliance, legal penalties, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for this vulnerability. Since the issue is resolved in the Linux kernel, updating to a patched version will remove the OOB read risk. If immediate patching is not possible, consider disabling the affected RDMA/irdma driver if it is not critical to your system's operation.

Hi! I’m here to help you understand CVE-2026-74346. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70