CVE-2026-74346 - Vulnerability Details

- RDMA/irdma: Fix OOB read during CQ MR registration

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix OOB read during CQ MR registration

Sashiko pointed out an unrelated bug during a previous patch:
https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com

This change fixes the bug by eliminating the cqmr->split field which
was not being set properly and instead just checks the CQ resize
feature flag directly.

The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE
is set, but it was not being set until CQ creation time, which is _after_
CQ memory registration (the only other place where it is referenced).

As a result, it would always be false during MR registration and would
therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2
HW and beyond:

cqmr->shadow = (dma_addr_t)arr[req->cq_pages];

The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal
to iwmr->page_cnt and therefore equal to the size of arr, which would cause
an OOB read by one.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An out‑of‑bounds read can occur during completion queue memory registration in the Linux RDMA/irdma driver. The bug arises because a flag that indicates whether the CQ resize feature is enabled is never set at the time of memory registration, causing the driver to copy a page pointer that may be beyond the bounds of the allocated array. The effect is that sensitive kernel memory can be read by the driver, potentially leaking data that should remain confidential. The weakness corresponds to incorrect bounds checking, a classic buffer over‑read scenario.

Affected Systems

All Linux kernel releases that include the irdma RDMA driver, regardless of distribution. The vulnerability is present until the kernel code is patched to remove the problematic field and use the feature flag directly.

Risk and Exploitability

The CVSS score is 5.5, indicating a medium severity. Based on the description, the vulnerability is likely exploitable from a user‑mode process that can load a generic RDMA driver, which is inferred and would make this a local kernel exploitation vector. The EPSS score is listed as "< 1%" and the flaw is not in the CISA KEV catalog. The flaw would allow an attacker with local privileges to read arbitrary kernel memory, which could be leveraged for further privilege escalation or to extract secrets.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b48c24c2d710cf34810c555dcef883a3d35a9c08`	affected	< a80b3b13786e9ab1c52b31a1f16c7d6708fa9220
`b48c24c2d710cf34810c555dcef883a3d35a9c08`	affected	< 3159c6fac43dc24b34d31971884d98a7a1bf4c4b
`b48c24c2d710cf34810c555dcef883a3d35a9c08`	affected	< ad360a31092a870633ec255b96f50181628b4de0
`b48c24c2d710cf34810c555dcef883a3d35a9c08`	affected	< d566002de555b18cc395012c5c1cb8682fc6d2a9
`b48c24c2d710cf34810c555dcef883a3d35a9c08`	affected	< 54cab78df0375196aaec4e3109191653d21751df
`b48c24c2d710cf34810c555dcef883a3d35a9c08`	affected	< d5aa82da8f65562da996d184686db9d0ea718b91
`b48c24c2d710cf34810c555dcef883a3d35a9c08`	affected	< 4385ddd654d90245eeb83b3cb539670ab5c85ba4

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b48c24c2d710cf34810c555dcef883a3d35a9c08,a80b3b13786e9ab1c52b31a1f16c7d6708fa9220)`	affected	code_commit	—
`[b48c24c2d710cf34810c555dcef883a3d35a9c08,3159c6fac43dc24b34d31971884d98a7a1bf4c4b)`	affected	code_commit	—
`[b48c24c2d710cf34810c555dcef883a3d35a9c08,ad360a31092a870633ec255b96f50181628b4de0)`	affected	code_commit	—
`[b48c24c2d710cf34810c555dcef883a3d35a9c08,d566002de555b18cc395012c5c1cb8682fc6d2a9)`	affected	code_commit	—
`[b48c24c2d710cf34810c555dcef883a3d35a9c08,54cab78df0375196aaec4e3109191653d21751df)`	affected	code_commit	—
`[b48c24c2d710cf34810c555dcef883a3d35a9c08,d5aa82da8f65562da996d184686db9d0ea718b91)`	affected	code_commit	—
`[b48c24c2d710cf34810c555dcef883a3d35a9c08,4385ddd654d90245eeb83b3cb539670ab5c85ba4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch removing the split field from the CQ MR registration code.
Restrict or disable the RDMA/irdma driver on systems where RDMA is not required, reducing the attack surface for local users.
Monitor system logs for RDMA‑related errors or abnormal activity that may indicate attempts to exploit memory registration.

Generated by OpenCVE AI on August 22, 2026 at 03:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3159c6fac43dc24b34d31971884d98a7a1bf4c4b
https://git.kernel.org/stable/c/4385ddd654d90245eeb83b3cb539670ab5c85ba4
https://git.kernel.org/stable/c/54cab78df0375196aaec4e3109191653d21751df
https://git.kernel.org/stable/c/a80b3b13786e9ab1c52b31a1f16c7d6708fa9220
https://git.kernel.org/stable/c/ad360a31092a870633ec255b96f50181628b4de0
https://git.kernel.org/stable/c/d566002de555b18cc395012c5c1cb8682fc6d2a9
https://git.kernel.org/stable/c/d5aa82da8f65562da996d184686db9d0ea718b91
https://lore.kernel.org/linux-cve-announce/2026081558-CVE-2026-74346-872c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74346
https://www.cve.org/CVERecord?id=CVE-2026-74346

History

Sat, 22 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026081558-CVE-2026-74346-872c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74346 https://www.cve.org/CVERecord?id=CVE-2026-74346
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one.
Title		RDMA/irdma: Fix OOB read during CQ MR registration
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3159c6fac43dc24b34d31971884d98a7a1bf4c4b https://git.kernel.org/stable/c/4385ddd654d90245eeb83b3cb539670ab5c85ba4 https://git.kernel.org/stable/c/54cab78df0375196aaec4e3109191653d21751df https://git.kernel.org/stable/c/a80b3b13786e9ab1c52b31a1f16c7d6708fa9220 https://git.kernel.org/stable/c/ad360a31092a870633ec255b96f50181628b4de0 https://git.kernel.org/stable/c/d566002de555b18cc395012c5c1cb8682fc6d2a9 https://git.kernel.org/stable/c/d5aa82da8f65562da996d184686db9d0ea718b91

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:34.606Z

Updated: 2026-08-17T05:17:38.929Z

Reserved: 2026-08-15T05:44:03.886Z

Link: CVE-2026-74346

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:35.720

Modified: 2026-08-17T06:19:29.180

Link: CVE-2026-74346

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74346 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T03:30:16Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object