CVE-2026-74394 RDMA/srpt: fix integer overflow in immediate data length check
A malicious network initiator can trigger an integer overflow in the Linux kernel RDMA subsystem, potentially leading to memory corruption or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74394?
CVE-2026-74394 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
Which versions are affected by CVE-2026-74394?
How do I fix CVE-2026-74394?
Apply the vendor's patch.
Is CVE-2026-74394 being exploited?
There is no known exploitation of CVE-2026-74394 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74394, DEBIAN-CVE-2026-74394, GHSA-f87m-vg23-g294, UBUNTU-CVE-2026-74394.