CVE-2026-74378

Received Received - Intake

Heap Overflow in Linux Kernel RDMA/rxe Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe. Read num_sge into a local variable and use it for both the bounds check and the size calculation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74378

EUVD

EUVD-2026-59525

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap overflow vulnerability in the Linux kernel's RDMA subsystem. It occurs in the get_srq_wqe() function where a race condition allows a userspace thread to modify a value between validation and use, causing a buffer overflow when copying data.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/rxe subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or using kernel debugging tools to inspect the RDMA/rxe module. No direct network or system commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code, escalate privileges, or cause a denial of service by triggering a heap overflow in the kernel's RDMA subsystem.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical memory corruption issue in the Linux kernel's RDMA subsystem. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. The context does not specify the exact kernel version, so check your distribution's security advisories for the patched release. If updating is not immediately possible, consider disabling the RDMA/rxe module if it is not required.

Hi! I’m here to help you understand CVE-2026-74378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70