Bug 2516773 (CVE-2026-74377)

Summary: CVE-2026-74377 kernel: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the rxe driver. A local malicious user can exploit this by modifying Work Queue Entry (WQE) fields in a shared queue buffer that is mapped into userspace. This manipulation occurs while the kernel is processing the WQE for non-Shared Receive Queue (SRQ) Queue Pairs (QPs). The vulnerability leads to out-of-bounds reads, which can result in information disclosure or system instability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:32:44 UTC 
In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path

For non-SRQ QPs, the responder reads WQE fields directly from the
shared queue buffer mapped into userspace. This allows a malicious
user to modify fields like num_sge or sge entries while the kernel
is processing the WQE, leading to out-of-bounds reads in
rxe_resp_check_length() and copy_data().

Introduce get_recv_wqe() that validates num_sge and copies the WQE
to a kernel-local buffer before processing, matching the approach
already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is
reused since SRQ and non-SRQ paths are mutually exclusive per QP.
Comment 1 Keith Grant 2026-08-20 19:38:32 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081504-CVE-2026-74377-9467@gregkh/T