CVE-2026-45856 RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
A local attacker can trigger an out-of-bounds read in the Linux kernel RDMA subsystem to leak sensitive kernel memory information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45856?
CVE-2026-45856 is a high-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr.
If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace.
Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller.
This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding.
Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).
Weakness: CWE-125
Which versions are affected by CVE-2026-45856?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45856?
Apply the vendor's patch.
Is CVE-2026-45856 being exploited?
There is no known exploitation of CVE-2026-45856 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-45856, DEBIAN-CVE-2026-45856, GHSA-xq3r-74hw-4c5p, ROOT-OS-DEBIAN-11-CVE-2026-45856, ROOT-OS-UBUNTU-2204-CVE-2026-45856, ROOT-OS-UBUNTU-2404-CVE-2026-45856 and 1 more.