CVE-2026-74378 (GCVE-0-2026-74378)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-09-14 11:58
VLAI
Title
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe. Read num_sge into a local variable and use it for both the bounds check and the size calculation.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe (git)
Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < e48daa94ad2d406225b73491fc935064716f0ec7 (git)
Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < 3cfa2a3adc51b7c57729961a03446962ff10e3d2 (git)
Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < cd19a6345e3727adafafa5954b58b13c92e13b80 (git)
Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < 3e07ea9579dc9553d2285c26c2823931358aa3b8 (git)
Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < 02558c86b6b761063e9399e6b939984500327ef1 (git)
Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < b9800d7953d119bcc068c74587d48e4ba0313629 (git)
Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < 22b8fbded65b8c441b634a185f8da67657df6c50 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "e48daa94ad2d406225b73491fc935064716f0ec7",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "3cfa2a3adc51b7c57729961a03446962ff10e3d2",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "cd19a6345e3727adafafa5954b58b13c92e13b80",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "3e07ea9579dc9553d2285c26c2823931358aa3b8",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "02558c86b6b761063e9399e6b939984500327ef1",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "b9800d7953d119bcc068c74587d48e4ba0313629",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "22b8fbded65b8c441b634a185f8da67657df6c50",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe\n\nget_srq_wqe() reads wqe-\u003edma.num_sge from the shared receive queue\nbuffer, which is mapped into userspace. It validates num_sge against\nmax_sge, but then re-reads the same field to calculate the memcpy\nsize. A concurrent userspace thread can modify num_sge between\nvalidation and use, causing a heap buffer overflow when copying the\nWQE into qp-\u003eresp.srq_wqe.\n\nRead num_sge into a local variable and use it for both the bounds\ncheck and the size calculation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim\u0027s userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap\u0027d SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap\u0027d queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap\u0027d SRQ ring buffer and overflows the fixed qp-\u003eresp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp-\u003eresp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:46.129Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/e48daa94ad2d406225b73491fc935064716f0ec7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cfa2a3adc51b7c57729961a03446962ff10e3d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd19a6345e3727adafafa5954b58b13c92e13b80"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e07ea9579dc9553d2285c26c2823931358aa3b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/02558c86b6b761063e9399e6b939984500327ef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9800d7953d119bcc068c74587d48e4ba0313629"
        },
        {
          "url": "https://git.kernel.org/stable/c/22b8fbded65b8c441b634a185f8da67657df6c50"
        }
      ],
      "title": "RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74378",
    "datePublished": "2026-08-15T05:58:56.381Z",
    "dateReserved": "2026-08-15T05:44:03.890Z",
    "dateUpdated": "2026-09-14T11:58:46.129Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74378",
      "date": "2026-09-21",
      "epss": "0.00143",
      "percentile": "0.03925"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/rxe/rxe_resp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe",
                    "status": "affected",
                    "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e48daa94ad2d406225b73491fc935064716f0ec7",
                    "status": "affected",
                    "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3cfa2a3adc51b7c57729961a03446962ff10e3d2",
                    "status": "affected",
                    "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd19a6345e3727adafafa5954b58b13c92e13b80",
                    "status": "affected",
                    "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3e07ea9579dc9553d2285c26c2823931358aa3b8",
                    "status": "affected",
                    "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "02558c86b6b761063e9399e6b939984500327ef1",
                    "status": "affected",
                    "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b9800d7953d119bcc068c74587d48e4ba0313629",
                    "status": "affected",
                    "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "22b8fbded65b8c441b634a185f8da67657df6c50",
                    "status": "affected",
                    "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/rxe/rxe_resp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.8"
                  },
                  {
                    "lessThan": "4.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe\n\nget_srq_wqe() reads wqe-\u003edma.num_sge from the shared receive queue\nbuffer, which is mapped into userspace. It validates num_sge against\nmax_sge, but then re-reads the same field to calculate the memcpy\nsize. A concurrent userspace thread can modify num_sge between\nvalidation and use, causing a heap buffer overflow when copying the\nWQE into qp-\u003eresp.srq_wqe.\n\nRead num_sge into a local variable and use it for both the bounds\ncheck and the size calculation."
          }
        ],
        "id": "CVE-2026-74378",
        "lastModified": "2026-09-14T12:17:45.817",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:39.597",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/02558c86b6b761063e9399e6b939984500327ef1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/22b8fbded65b8c441b634a185f8da67657df6c50"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3cfa2a3adc51b7c57729961a03446962ff10e3d2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3e07ea9579dc9553d2285c26c2823931358aa3b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b9800d7953d119bcc068c74587d48e4ba0313629"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd19a6345e3727adafafa5954b58b13c92e13b80"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e48daa94ad2d406225b73491fc935064716f0ec7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T20:53:34+00:00",
      "cve": "CVE-2026-74378",
      "id": "CVE-2026-74378",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74378.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:21:59Z",
      "cve": "CVE-2026-74378",
      "id": "CVE-2026-74378",
      "initial_release_date": "2026-09-03T00:06:41Z",
      "product_status:first_fixed": "123",
      "product_status:known_affected": "358",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74378",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74378.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.