CVE-2026-74297
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the RDMA/mlx5 driver has an undefined shift of user RQ WQE size. set_rq_size() computes the size as "1 << rq_wqe_shift" based on user-provided value, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. The fix uses check_shl_overflow() to compute the size and rejects invalid values.
Risk Assessment
A local user with privileges to create RQ queues could cause undefined kernel behavior, potentially leading to a crash or privilege escalation.
Recommendation
Update the Linux kernel to a version with the fix for CVE-2026-74297. Restrict access to RDMA interfaces for unauthorized users.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.