CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
immbuf->len is a user-controlled uint32t received from the network. Adding it to immdataoffset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing reqsize to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sginitone().
Use checkaddoverflow() to detect wrapping before the comparison.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74394?
CVE-2026-74394 has been assigned a risk rating of 65.
How do I fix CVE-2026-74394?
To fix CVE-2026-74394, ensure you update your Linux kernel to the latest version where the vulnerability has been patched.
What type of vulnerability is CVE-2026-74394?
CVE-2026-74394 is classified as an Integer Overflow vulnerability.
What are the potential impacts of CVE-2026-74394?
The vulnerability can allow a malicious initiator to exploit the integer overflow, leading to potential unintended behaviors in the system.
When was CVE-2026-74394 published?
CVE-2026-74394 was published on August 15, 2026.