CVE-2026-74394

Received Received - Intake

RDMA srpt Integer Overflow in Immediate Data Length Check

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74394

EUVD

EUVD-2026-59541

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's RDMA/srpt component. It involves an integer overflow in the immediate data length check. A malicious user can send a large value (0xFFFFFFFF) for the length field, causing a wrap-around that bypasses size checks and allows passing a very large buffer (~4GB) to sg_init_one().

Detection Guidance

This vulnerability involves a kernel-level integer overflow in the RDMA subsystem. Detection requires checking for unusual network traffic patterns targeting RDMA services or examining kernel logs for crashes related to sg_init_one() calls. Monitor for kernel panics or memory corruption errors in logs.

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing the system or trigger memory corruption, potentially leading to arbitrary code execution. Systems using affected Linux kernel versions with RDMA/srpt enabled are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to memory handling in the Linux RDMA subsystem. Compliance impacts would only occur if exploitation led to unauthorized data access or denial of service, which is not specified in the provided context.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. If patching is not immediately possible, disable the RDMA subsystem (srpt module) by unloading it with 'modprobe -r ib_srpt' or block network access to RDMA ports. Update to a patched kernel version as soon as available.

Hi! I’m here to help you understand CVE-2026-74394. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70