CVE-2026-74378RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe. Read num_sge into a local variable and use it for both the bounds check and the size calculation.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8700e3e7c4857d28ebaa824509934556da0b3e76 before c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before e48daa94ad2d406225b73491fc935064716f0ec7; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 3cfa2a3adc51b7c57729961a03446962ff10e3d2; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before cd19a6345e3727adafafa5954b58b13c92e13b80; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 3e07ea9579dc9553d2285c26c2823931358aa3b8; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 02558c86b6b761063e9399e6b939984500327ef1; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before b9800d7953d119bcc068c74587d48e4ba0313629; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 22b8fbded65b8c441b634a185f8da67657df6c50 | CNA record |
References
- https://git.kernel.org/stable/c/c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe
- https://git.kernel.org/stable/c/e48daa94ad2d406225b73491fc935064716f0ec7
- https://git.kernel.org/stable/c/3cfa2a3adc51b7c57729961a03446962ff10e3d2
- https://git.kernel.org/stable/c/cd19a6345e3727adafafa5954b58b13c92e13b80
- https://git.kernel.org/stable/c/3e07ea9579dc9553d2285c26c2823931358aa3b8
- https://git.kernel.org/stable/c/02558c86b6b761063e9399e6b939984500327ef1
- https://git.kernel.org/stable/c/b9800d7953d119bcc068c74587d48e4ba0313629
- https://git.kernel.org/stable/c/22b8fbded65b8c441b634a185f8da67657df6c50
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.