CVE-2026-74378 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems that use the RDMA/rxe component, as well as security teams and operators managing Linux systems in their environments, should assess exposure and apply patches or mitigations to prevent exploitation.

Why it matters

A TOCTOU heap overflow vulnerability in the Linux kernel's RDMA/rxe component can lead to denial of service or code execution. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems that use the RDMA/rxe component should assess exposure and apply patches or mitigations to prevent exploitation.

• Heap buffer overflow can lead to denial of service or code execution
• Vulnerability requires patching or mitigation to prevent exploitation
• Exploitation can result in system crashes or instability
• Verification of patch application and system configuration is necessary

Technical summary

The `get_srq_wqe()` function in the Linux kernel's RDMA/rxe component is vulnerable to a TOCTOU heap overflow. The function reads `wqe->dma.num_sge` from the shared receive queue buffer, which is mapped into userspace. It validates `num_sge` against `max_sge`, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify `num_sge` between validation and use, causing a heap buffer overflow when copying the WQE into `qp->resp.srq_wqe`.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to fix the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor the Linux kernel's vulnerability management process for updates
• Perform a thorough review of system configurations and patch application
• Verify system stability after applying patches
• Track changes to the Linux kernel's vulnerability management process
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability is caused by a race condition between validation and use of the `num_sge` field in the shared receive queue buffer. The `get_srq_wqe()` function reads `wqe->dma.num_sge` from the shared receive queue buffer, which is mapped into userspace. It validates `num_sge` against `max_sge`, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify `num_sge` between validation and use, causing a heap buffer overflow when copying the WQE into `qp->resp.srq_wqe`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.