CVE-2026-74297RDMA/mlx5: Fix undefined shift of user RQ WQE size
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c before 9fff54929cc00849d738faa99f06c32399aeb026; from e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c before b746f949c2ac2b041102836095d6d4a2ef21fa75; from e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c before c1dbf52d24a8cb1aa56780ba51b72e7d495f258c; from e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c before 6fc874fdfb366bfb11c62e6af9a831c8be59ddda; from e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c before 42f3d2c8c18b92ea33e506a38b64f1a8986c2823; from e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c before 4b87a2497276a72fd63028e7419abf0fb7ed837b; from e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c before b732db02a2b04cde393638df19de6251ce62a74e; from e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c before d881d60223aac8fdc12b227d89c76e131e92a9cd | CNA record |
References
- https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026
- https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75
- https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c
- https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda
- https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823
- https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b
- https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e
- https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.