0.0
NA
CVE-2026-74346
RDMA/irdma: Fix OOB read during CQ MR registration
Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one.

INFO

Published Date :

Aug. 15, 2026, 6:22 a.m.

Last Modified :

Aug. 15, 2026, 6:22 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-74346 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Fix out-of-bounds read by removing unnecessary split field and checking feature flag.
  • Remove the cqmr->split field.
  • Check the CQ resize feature flag directly.
  • Update the Linux kernel to the latest version.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-74346 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-74346 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-74346 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-74346 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': 'a80b3b13786e9ab1c52b31a1f16c7d6708fa9220', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': '3159c6fac43dc24b34d31971884d98a7a1bf4c4b', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': 'ad360a31092a870633ec255b96f50181628b4de0', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': 'd566002de555b18cc395012c5c1cb8682fc6d2a9', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': '54cab78df0375196aaec4e3109191653d21751df', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': 'd5aa82da8f65562da996d184686db9d0ea718b91', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48c24c2d710cf34810c555dcef883a3d35a9c08', 'lessThan': '4385ddd654d90245eeb83b3cb539670ab5c85ba4', 'versionType': 'git'}], 'programFiles': ['drivers/infiniband/hw/irdma/verbs.c', 'drivers/infiniband/hw/irdma/verbs.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/infiniband/hw/irdma/verbs.c', 'drivers/infiniband/hw/irdma/verbs.h'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one.
    Added Reference https://git.kernel.org/stable/c/3159c6fac43dc24b34d31971884d98a7a1bf4c4b
    Added Reference https://git.kernel.org/stable/c/4385ddd654d90245eeb83b3cb539670ab5c85ba4
    Added Reference https://git.kernel.org/stable/c/54cab78df0375196aaec4e3109191653d21751df
    Added Reference https://git.kernel.org/stable/c/a80b3b13786e9ab1c52b31a1f16c7d6708fa9220
    Added Reference https://git.kernel.org/stable/c/ad360a31092a870633ec255b96f50181628b4de0
    Added Reference https://git.kernel.org/stable/c/d566002de555b18cc395012c5c1cb8682fc6d2a9
    Added Reference https://git.kernel.org/stable/c/d5aa82da8f65562da996d184686db9d0ea718b91
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.