CVE-2026-74346
RDMA/irdma: Fix OOB read during CQ MR registration
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one.
INFO
Published Date :
Aug. 15, 2026, 6:22 a.m.
Last Modified :
Aug. 15, 2026, 6:22 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74346
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Remove the cqmr->split field.
- Check the CQ resize feature flag directly.
- Update the Linux kernel to the latest version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74346.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74346 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74346
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74346 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74346 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': 'a80b3b13786e9ab1c52b31a1f16c7d6708fa9220', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': '3159c6fac43dc24b34d31971884d98a7a1bf4c4b', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': 'ad360a31092a870633ec255b96f50181628b4de0', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': 'd566002de555b18cc395012c5c1cb8682fc6d2a9', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': '54cab78df0375196aaec4e3109191653d21751df', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': 'd5aa82da8f65562da996d184686db9d0ea718b91', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': '4385ddd654d90245eeb83b3cb539670ab5c85ba4', 'versionType': 'git'}], 'programFiles': ['drivers/infiniband/hw/irdma/verbs.c', 'drivers/infiniband/hw/irdma/verbs.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/infiniband/hw/irdma/verbs.c', 'drivers/infiniband/hw/irdma/verbs.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one. Added Reference https://git.kernel.org/stable/c/3159c6fac43dc24b34d31971884d98a7a1bf4c4b Added Reference https://git.kernel.org/stable/c/4385ddd654d90245eeb83b3cb539670ab5c85ba4 Added Reference https://git.kernel.org/stable/c/54cab78df0375196aaec4e3109191653d21751df Added Reference https://git.kernel.org/stable/c/a80b3b13786e9ab1c52b31a1f16c7d6708fa9220 Added Reference https://git.kernel.org/stable/c/ad360a31092a870633ec255b96f50181628b4de0 Added Reference https://git.kernel.org/stable/c/d566002de555b18cc395012c5c1cb8682fc6d2a9 Added Reference https://git.kernel.org/stable/c/d5aa82da8f65562da996d184686db9d0ea718b91