CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix undefined shift of user RQ WQE size
setrqsize() computes the RQ WQE size as "1 << rqwqeshift" based on the user-provided rqwqeshift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior.
Use checkshloverflow() to compute the RQ WQE size and reject any invalid values.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until patched, reject user-provided RDMA RQ WQE shift values that would cause an overflow/undefined shift (i.e., validate rq_wqe_shift using check_shl_overflow() logic and reject invalid values rather than only checking it is greater than some threshold).