CVE-2026-74346RDMA/irdma: Fix OOB read during CQ MR registration
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b48c24c2d710cf34810c555dcef883a3d35a9c08 before a80b3b13786e9ab1c52b31a1f16c7d6708fa9220; from b48c24c2d710cf34810c555dcef883a3d35a9c08 before 3159c6fac43dc24b34d31971884d98a7a1bf4c4b; from b48c24c2d710cf34810c555dcef883a3d35a9c08 before ad360a31092a870633ec255b96f50181628b4de0; from b48c24c2d710cf34810c555dcef883a3d35a9c08 before d566002de555b18cc395012c5c1cb8682fc6d2a9; from b48c24c2d710cf34810c555dcef883a3d35a9c08 before 54cab78df0375196aaec4e3109191653d21751df; from b48c24c2d710cf34810c555dcef883a3d35a9c08 before d5aa82da8f65562da996d184686db9d0ea718b91; from b48c24c2d710cf34810c555dcef883a3d35a9c08 before 4385ddd654d90245eeb83b3cb539670ab5c85ba4 | CNA record |
References
- https://git.kernel.org/stable/c/a80b3b13786e9ab1c52b31a1f16c7d6708fa9220
- https://git.kernel.org/stable/c/3159c6fac43dc24b34d31971884d98a7a1bf4c4b
- https://git.kernel.org/stable/c/ad360a31092a870633ec255b96f50181628b4de0
- https://git.kernel.org/stable/c/d566002de555b18cc395012c5c1cb8682fc6d2a9
- https://git.kernel.org/stable/c/54cab78df0375196aaec4e3109191653d21751df
- https://git.kernel.org/stable/c/d5aa82da8f65562da996d184686db9d0ea718b91
- https://git.kernel.org/stable/c/4385ddd654d90245eeb83b3cb539670ab5c85ba4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.