CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe

getsrqwqe() reads wqe->dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validates numsge against maxsge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify numsge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srqwqe.

Read numsge into a local variable and use it for both the bounds check and the size calculation.