RDMA/srpt: fix integer overflow in immediate data length check
Summary
| CVE | CVE-2026-74394 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-08-15 06:22:41 UTC |
|---|
| Updated | 2026-08-15 06:22:41 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d git |
Not specified |
| CNA |
Linux |
Linux |
affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 3efa5301137140a3ca3677a9098c0a93a0acfd49 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 067b9556eeb007f28b7c2033b4dcde5b6d88418f git |
Not specified |
| CNA |
Linux |
Linux |
affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 dcf7a986f377cce0749ed53f1d64195fbd5fdf91 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e git |
Not specified |
| CNA |
Linux |
Linux |
affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 65572fbd86033ae2370125593d59b8be34253aaf git |
Not specified |
| CNA |
Linux |
Linux |
affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 72497172a4799119a0282a5eb5e2b8ddcc821921 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 eb4ecdf631fe00e8020bf461503cb9b7017ed796 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5.0 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.0 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.10.261 5.10.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.15.212 5.15.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.178 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.145 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.97 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.40 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.1.5 7.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2-rc1 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418f |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aaf |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.