Vulnerability-Lookup

BDU:2026-16652 (CVE-2026-74297)

Vulnerability from fstec – Published: 2026-10-16 – Updated: 2026-10-16 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции set_rq_size() компонента drivers/infiniband/hw/mlx5/qp.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость функции set_rq_size() компонента drivers/infiniband/hw/mlx5/qp.c ядра операционной системы Linux связана с реализацией некорректного потока управления. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

7.8 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-691 - Недостаточное управление потоком

Aliases

CVE-2026-74297, GHSA-P4JX-GH49-76WV

References

16 references

URL
https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823
https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b
https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda
https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026
https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e
https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75
https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c
https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd
https://github.com/advisories/GHSA-p4jx-gh49-76wv
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
http://repo.red-soft.ru/redos/8.0/aarch64/updates/
https://security-tracker.debian.org/tracker/CVE-2026-74297
https://deb.freexian.com/extended-lts/tracker/CVE-2026-74297
https://access.redhat.com/security/cve/CVE-2026-74297
https://ubuntu.com/security/CVE-2026-74297

Impacted products

5 products from 5 vendors

Vendors

Red Hat, Inc., Canonical Ltd., Сообщество свободного программного обеспечения, ООО «Ред Софт»

Products

Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, РЕД ОС (запись в едином реестре российских программ №3751), Linux

Versions

7 (Red Hat Enterprise Linux), 16.04 LTS (Ubuntu), 9 (Debian GNU/Linux), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (РЕД ОС), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 10 (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.0 (РЕД ОС), 26.04 LTS (Ubuntu), от 6.2 до 6.6.145 (Linux), от 6.7 до 6.12.97 (Linux), от 6.13 до 6.18.40 (Linux), от 6.19 до 7.1.5 (Linux), от 5.16 до 6.1.178 (Linux), от 5.11 до 5.15.212 (Linux), от 3.11 до 5.10.261 (Linux)

Product types

Operating system

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 7, Canonical Ltd. Ubuntu 16.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 9, Canonical Ltd. Ubuntu 18.04 LTS, Inc. Red Hat Enterprise Linux 8, Сообщество свободного программного обеспечения Debian GNU/Linux 10, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Сообщество свободного программного обеспечения Debian GNU/Linux 12, ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751), Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, Canonical Ltd. Ubuntu 24.04 LTS, Inc. Red Hat Enterprise Linux 10, Сообщество свободного программного обеспечения Debian GNU/Linux 13, ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751), Canonical Ltd. Ubuntu 26.04 LTS, Сообщество свободного программного обеспечения Linux от 6.2 до 6.6.145, Сообщество свободного программного обеспечения Linux от 6.7 до 6.12.97, Сообщество свободного программного обеспечения Linux от 6.13 до 6.18.40, Сообщество свободного программного обеспечения Linux от 6.19 до 7.1.5, Сообщество свободного программного обеспечения Linux от 5.16 до 6.1.178, Сообщество свободного программного обеспечения Linux от 5.11 до 5.15.212, Сообщество свободного программного обеспечения Linux от 3.11 до 5.10.261

Mitigations

Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823 https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026 https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75 https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd Для Ред ОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ http://repo.red-soft.ru/redos/8.0/x86_64/updates/ http://repo.red-soft.ru/redos/8.0/aarch64/updates/ Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2026-74297 https://deb.freexian.com/extended-lts/tracker/CVE-2026-74297 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/CVE-2026-74297 Для Ubuntu: https://ubuntu.com/security/CVE-2026-74297

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7 (Red Hat Enterprise Linux), 16.04 LTS (Ubuntu), 9 (Debian GNU/Linux), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 10 (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.0 (\u0420\u0415\u0414 \u041e\u0421), 26.04 LTS (Ubuntu), \u043e\u0442 6.2 \u0434\u043e 6.6.145 (Linux), \u043e\u0442 6.7 \u0434\u043e 6.12.97 (Linux), \u043e\u0442 6.13 \u0434\u043e 6.18.40 (Linux), \u043e\u0442 6.19 \u0434\u043e 7.1.5 (Linux), \u043e\u0442 5.16 \u0434\u043e 6.1.178 (Linux), \u043e\u0442 5.11 \u0434\u043e 5.15.212 (Linux), \u043e\u0442 3.11 \u0434\u043e 5.10.261 (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823\nhttps://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b\nhttps://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda\nhttps://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026\nhttps://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e\nhttps://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75\nhttps://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c\nhttps://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd \n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421:\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/aarch64/updates/\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-74297\nhttps://deb.freexian.com/extended-lts/tracker/CVE-2026-74297\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/CVE-2026-74297\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2026-74297",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "11.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "16.10.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "16.10.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-16652",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-74297, GHSA-P4JX-GH49-76WV",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 7 , Canonical Ltd. Ubuntu 16.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 9 , Canonical Ltd. Ubuntu 18.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 8 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , Canonical Ltd. Ubuntu 24.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 10 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 13 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Canonical Ltd. Ubuntu 26.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.2 \u0434\u043e 6.6.145 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.7 \u0434\u043e 6.12.97 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.13 \u0434\u043e 6.18.40 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.19 \u0434\u043e 7.1.5 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.16 \u0434\u043e 6.1.178 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.11 \u0434\u043e 5.15.212 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 3.11 \u0434\u043e 5.10.261 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 set_rq_size() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 drivers/infiniband/hw/mlx5/qp.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0442\u043e\u043a\u043e\u043c (CWE-691)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 set_rq_size() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 drivers/infiniband/hw/mlx5/qp.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823\nhttps://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b\nhttps://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda\nhttps://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026\nhttps://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e\nhttps://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75\nhttps://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c\nhttps://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd\nhttps://github.com/advisories/GHSA-p4jx-gh49-76wv\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/aarch64/updates/\nhttps://security-tracker.debian.org/tracker/CVE-2026-74297\nhttps://deb.freexian.com/extended-lts/tracker/CVE-2026-74297\nhttps://access.redhat.com/security/cve/CVE-2026-74297\nhttps://ubuntu.com/security/CVE-2026-74297",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-691",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)"
}

CVE-2026-74297 (GCVE-0-2026-74297)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-10-16 18:55

Title

RDMA/mlx5: Fix undefined shift of user RQ WQE size

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:52 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/9fff54929cc00849d…
https://git.kernel.org/stable/c/b746f949c2ac2b041…
https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa…
https://git.kernel.org/stable/c/6fc874fdfb366bfb1…
https://git.kernel.org/stable/c/42f3d2c8c18b92ea3…
https://git.kernel.org/stable/c/4b87a2497276a72fd…
https://git.kernel.org/stable/c/b732db02a2b04cde3…
https://git.kernel.org/stable/c/d881d60223aac8fdc…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < 9fff54929cc00849d738faa99f06c32399aeb026 (git) Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < b746f949c2ac2b041102836095d6d4a2ef21fa75 (git) Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < c1dbf52d24a8cb1aa56780ba51b72e7d495f258c (git) Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < 6fc874fdfb366bfb11c62e6af9a831c8be59ddda (git) Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < 42f3d2c8c18b92ea33e506a38b64f1a8986c2823 (git) Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < 4b87a2497276a72fd63028e7419abf0fb7ed837b (git) Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < b732db02a2b04cde393638df19de6251ce62a74e (git) Affected: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c , < d881d60223aac8fdc12b227d89c76e131e92a9cd (git)
Linux	Linux	Affected: 3.11 Unaffected: 0 , < 3.11 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74297",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:52:40.390681Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:55:31.425Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9fff54929cc00849d738faa99f06c32399aeb026",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "b746f949c2ac2b041102836095d6d4a2ef21fa75",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "c1dbf52d24a8cb1aa56780ba51b72e7d495f258c",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "6fc874fdfb366bfb11c62e6af9a831c8be59ddda",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "42f3d2c8c18b92ea33e506a38b64f1a8986c2823",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "4b87a2497276a72fd63028e7419abf0fb7ed837b",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "b732db02a2b04cde393638df19de6251ce62a74e",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "d881d60223aac8fdc12b227d89c76e131e92a9cd",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix undefined shift of user RQ WQE size\n\nset_rq_size() computes the RQ WQE size as \"1 \u003c\u003c rq_wqe_shift\" based on\nthe user-provided rq_wqe_shift, which is only checked to be greater than\n32, so shifts of 32 are still accepted. A shift of 31 also overflows a\nsigned integer, leading to undefined behavior.\n\nUse check_shl_overflow() to compute the RQ WQE size and reject any\ninvalid values."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to IB_USER_VERBS_CMD_CREATE_QP; malicious rq_wqe_shift is supplied in mlx5_ib_create_qp userspace data, not from remote RDMA/InfiniBand wire traffic.\nAC:L - An attacker with uverbs access can deterministically pass rq_wqe_shift values 31 or 32 in create_qp driver udata; no races or victim state beyond opening the device and issuing the ioctl are required.\nPR:L - Only local access to the RDMA character device is required (typically rdma group membership on HPC/AI cloud GPU nodes), not init-namespace root; this matches basic local user capability rather than administrator privilege.\nUI:N - No victim interaction is needed; the attacker triggers the flaw entirely through their own create_qp ioctl with crafted mlx5_ib_create_qp fields.\nS:U - Impact stays within the kernel and RDMA context of the attacking process/tenant; it is not a VM-hypervisor or cross-security-authority boundary escape despite using a network-capable NIC.\nC:H - Integer overflow/undefined shift can undersize ib_umem registration while hardware is programmed with a huge RQ stride, enabling out-of-bounds DMA reads and kernel/user memory disclosure beyond the registered queue buffer.\nI:H - Corrupted max_gs (e.g. negative from shift 31) bypasses scatter/gather limits in post_recv, and undersized buffers with oversized hardware stride allow out-of-bounds writes and exploitable memory corruption.\nA:H - Undefined signed shifts and inconsistent queue sizing can cause kernel oops/panic during QP setup or later queue operations, and misprogrammed hardware can hang or crash the host under active RDMA use."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:36.087Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026"
        },
        {
          "url": "https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda"
        },
        {
          "url": "https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd"
        }
      ],
      "title": "RDMA/mlx5: Fix undefined shift of user RQ WQE size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74297",
    "datePublished": "2026-08-15T05:58:01.414Z",
    "dateReserved": "2026-08-15T05:44:03.882Z",
    "dateUpdated": "2026-10-16T18:55:31.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-P4JX-GH49-76WV

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix undefined shift of user RQ WQE size

set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior.

Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74297"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:29Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix undefined shift of user RQ WQE size\n\nset_rq_size() computes the RQ WQE size as \"1 \u003c\u003c rq_wqe_shift\" based on\nthe user-provided rq_wqe_shift, which is only checked to be greater than\n32, so shifts of 32 are still accepted. A shift of 31 also overflows a\nsigned integer, leading to undefined behavior.\n\nUse check_shl_overflow() to compute the RQ WQE size and reject any\ninvalid values.",
  "id": "GHSA-p4jx-gh49-76wv",
  "modified": "2026-08-17T06:33:37Z",
  "published": "2026-08-15T06:32:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74297"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2026-16652 (CVE-2026-74297)

CVE-2026-74297 (GCVE-0-2026-74297)

GHSA-P4JX-GH49-76WV

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour