https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:34:37 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74394 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>RDMA/srpt: fix integer overflow in immediate data length check</p> <p>imm_buf-&gt;len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one().</p> <p>Use check_add_overflow() to detect wrapping before the comparison.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>RDMA/srpt: fix integer overflow in immediate data length check</p> <p>imm_buf-&gt;len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one().</p> <p>Use check_add_overflow() to detect wrapping before the comparison.</p> https://vulnerability.circl.lu/vuln/cve-2026-74394