{"id":"CVE-2026-74346","summary":"RDMA/irdma: Fix OOB read during CQ MR registration","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix OOB read during CQ MR registration\n\nSashiko pointed out an unrelated bug during a previous patch:\nhttps://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com\n\nThis change fixes the bug by eliminating the cqmr-\u003esplit field which\nwas not being set properly and instead just checks the CQ resize\nfeature flag directly.\n\nThe cqmr-\u003esplit field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE\nis set, but it was not being set until CQ creation time, which is _after_\nCQ memory registration (the only other place where it is referenced).\n\nAs a result, it would always be false during MR registration and would\ntherefore cause irdma_handle_q_mem to populate cqmr-\u003eshadow even for GEN_2\nHW and beyond:\n\n    cqmr-\u003eshadow = (dma_addr_t)arr[req-\u003ecq_pages];\n\nThe issue is that for GEN_2 and beyond, req-\u003ecq_pages may be exactly equal\nto iwmr-\u003epage_cnt and therefore equal to the size of arr, which would cause\nan OOB read by one.","modified":"2026-08-18T03:31:26.140951214Z","published":"2026-08-15T05:58:34.606Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74346.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3159c6fac43dc24b34d31971884d98a7a1bf4c4b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4385ddd654d90245eeb83b3cb539670ab5c85ba4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/54cab78df0375196aaec4e3109191653d21751df"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a80b3b13786e9ab1c52b31a1f16c7d6708fa9220"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ad360a31092a870633ec255b96f50181628b4de0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d566002de555b18cc395012c5c1cb8682fc6d2a9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d5aa82da8f65562da996d184686db9d0ea718b91"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74346.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74346"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b48c24c2d710cf34810c555dcef883a3d35a9c08"},{"fixed":"a80b3b13786e9ab1c52b31a1f16c7d6708fa9220"},{"fixed":"3159c6fac43dc24b34d31971884d98a7a1bf4c4b"},{"fixed":"ad360a31092a870633ec255b96f50181628b4de0"},{"fixed":"d566002de555b18cc395012c5c1cb8682fc6d2a9"},{"fixed":"54cab78df0375196aaec4e3109191653d21751df"},{"fixed":"d5aa82da8f65562da996d184686db9d0ea718b91"},{"fixed":"4385ddd654d90245eeb83b3cb539670ab5c85ba4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74346.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.14.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74346.json"}}],"schema_version":"1.9.0"}