CVE-2026-74377

Received Received - Intake

RDMA/rxe WQE Memory Corruption in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data(). Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74377

EUVD

EUVD-2026-59524

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the RDMA/rxe driver where a malicious user can modify Work Queue Entry (WQE) fields like num_sge or sge entries while the kernel processes them. This leads to out-of-bounds reads in functions like rxe_resp_check_length() and copy_data(). The fix introduces a new function get_recv_wqe() to validate num_sge and copy the WQE to a kernel-local buffer before processing.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/rxe driver and requires kernel-level inspection. Detection involves checking kernel logs for RDMA-related errors or monitoring for unexpected behavior in RDMA operations. Commands like dmesg | grep -i rxe or journalctl -k | grep -i rxe may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a denial of service or potentially execute arbitrary code in the kernel. It may lead to system crashes, data corruption, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level kernel memory corruption issue in the Linux RDMA subsystem. Compliance risks would arise only if exploitation led to unauthorized data access or system compromise, which is not described in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, disable the RDMA/rxe driver if not in use by blacklisting the module (e.g., echo blacklist rxe >> /etc/modprobe.d/disable-rxe.conf). Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-74377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70