Linux kernel mlx5_ib (queue pair sizing): set_rq_size() computes the receive-queue work-entry size as 1 << rq_wqe_shift

CVE-2026-74297Kernel, userspace & hypervisorRDMA/mlx5 fix undefined shift of user RQ WQE sizecurated

Impact

set_rq_size() computes the receive-queue work-entry size as 1 << rq_wqe_shift from a user-supplied shift that is only checked against being greater than 32, so shifts of 31 and 32 pass and overflow. A tenant process controls a shift that the kernel then uses to size an allocation - the classic setup for heap corruption from an RDMA verbs call.

Who can reach it

Local, low-privileged - any process that can create an RDMA queue pair on an mlx5 device.

What to do

Upgrade the host kernel to 7.2 or a stable backport (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5). Rolling reboot across the RDMA fleet.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-74297 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74297.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.