UBUNTU-CVE-2026-45856: Security vulnerability
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqesize before using it in ibuverbspostsend ibuverbspostsend() uses cmd.wqesize from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ibuverbssendwr. If a user provides a small wqesize value (e.g., 1), kmalloc() will succeed, but subsequent accesses to userwr->opcode, userwr->numsge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqesize can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ibuverbsunmarshallrecv() which properly validates that wqesize >= sizeof(struct ibuverbsrecvwr) before proceeding. Add the same validation for ibuverbspostsend() to ensure wqesize is at least sizeof(struct ibuverbssendwr).