CVE-2026-74390

Received Received - Intake

Out-of-Bounds Write in Linux Kernel RDMA/irdma Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs The irdma_copy_user_pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc->total_cnt is reached. The issue is that the logic for checking palloc->total_cnt would only work for non-zero values. When irdma_setup_pbles is called with lvl==0, it calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means the only way to break out of the loop is to reach the last umem DMA block, which means it could end up going beyond the fixed size of 4 iwmr->pgaddrmem array that is used in the lvl==0 case. In the case of QP/CQ/SRQ rings, the value of lvl is determined by a separate input (for example, req.cq_pages in the case of a CQ). So, we must perform explicit checking to ensure we don't overflow the pgaddrmem array if the user provides a umem that consists of more blocks than their provided req.cq_pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74390

EUVD

EUVD-2026-59537

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the irdma_copy_user_pgaddrs function incorrectly handles a zero value for palloc->total_cnt. When called with lvl==0, it fails to stop the loop properly, potentially writing beyond the fixed-size pgaddrmem array. This occurs because the loop only checks for non-zero total_cnt values, leading to an out-of-bounds write if the user provides more DMA blocks than expected.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/irdma driver and involves an out-of-bounds write in the irdma_copy_user_pgaddrs function. Detection requires checking for kernel versions affected by this issue and monitoring for related crashes or memory corruption in RDMA operations.

Impact Analysis

This vulnerability could allow an attacker with local access to cause memory corruption in the Linux kernel. This might lead to system crashes, privilege escalation, or other unintended behavior. Systems using RDMA (Remote Direct Memory Access) with the irdma driver are particularly affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory corruption issue in the Linux kernel's RDMA subsystem. Compliance impacts would depend on whether the affected system processes sensitive data, but the vulnerability itself is not a compliance violation.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If immediate patching is not possible, disable the affected RDMA/irdma driver or restrict access to RDMA operations until the update is applied.

Hi! I’m here to help you understand CVE-2026-74390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70