CVE-2026-74377 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
A race condition in the Linux kernel RDMA subsystem allows local attackers to trigger out-of-bounds reads by modifying shared queue entries during processing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74377?
CVE-2026-74377 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data().
Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP.
Which versions are affected by CVE-2026-74377?
How do I fix CVE-2026-74377?
Apply the vendor's patch.
Is CVE-2026-74377 being exploited?
There is no known exploitation of CVE-2026-74377 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74377, DEBIAN-CVE-2026-74377, GHSA-jhmh-x5rf-hwf7, UBUNTU-CVE-2026-74377.