CVE-2026-74378
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel, the RDMA/rxe driver has been fixed for a TOCTOU heap overflow in get_srq_wqe(). The function reads num_sge from the shared receive queue buffer mapped into userspace, validates it, but then re-reads the same field to calculate memcpy size, allowing a concurrent thread to modify it and cause a heap buffer overflow.
Risk Assessment
The vulnerability may be exploited locally to escalate privileges or cause a denial of service (DoS) via heap overflow.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix for CVE-2026-74378.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe. Read num_sge into a local variable and use it for both the bounds check and the size calculation.