High 7.8Published Aug 15, 2026

CVE-2026-74378RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

Updated under an hour ago (Oct 26, 2026, 9:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe. Read num_sge into a local variable and use it for both the bounds check and the size calculation.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8700e3e7c4857d28ebaa824509934556da0b3e76 before c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before e48daa94ad2d406225b73491fc935064716f0ec7; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 3cfa2a3adc51b7c57729961a03446962ff10e3d2; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before cd19a6345e3727adafafa5954b58b13c92e13b80; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 3e07ea9579dc9553d2285c26c2823931358aa3b8; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 02558c86b6b761063e9399e6b939984500327ef1; from 8700e3e7c4857d28ebaa824509934556da0b3e76 before b9800d7953d119bcc068c74587d48e4ba0313629; 8700e3e7c4857d28ebaa824509934556da0b3e76 builds before 22b8fbded65b8c441b634a185f8da67657df6c50	CNA record

References

References

https://git.kernel.org/stable/c/c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe
https://git.kernel.org/stable/c/e48daa94ad2d406225b73491fc935064716f0ec7
https://git.kernel.org/stable/c/3cfa2a3adc51b7c57729961a03446962ff10e3d2
https://git.kernel.org/stable/c/cd19a6345e3727adafafa5954b58b13c92e13b80
https://git.kernel.org/stable/c/3e07ea9579dc9553d2285c26c2823931358aa3b8
https://git.kernel.org/stable/c/02558c86b6b761063e9399e6b939984500327ef1
https://git.kernel.org/stable/c/b9800d7953d119bcc068c74587d48e4ba0313629
https://git.kernel.org/stable/c/22b8fbded65b8c441b634a185f8da67657df6c50

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.