PT-2026-43723 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-45856

NVD

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Validate wqe size before using it in ib uverbs post send

ib uverbs post send() uses cmd.wqe size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib uverbs send wr.

If a user provides a small wqe size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user wr->opcode, user wr->num sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace.

Additionally, providing an excessively large wqe size can trigger a WARNING in the memory allocation path, as reported by syzkaller.

This is inconsistent with ib uverbs unmarshall recv() which properly validates that wqe size >= sizeof(struct ib uverbs recv wr) before proceeding.

Add the same validation for ib uverbs post send() to ensure wqe size is at least sizeof(struct ib uverbs send wr).

Fix

Related Identifiers

CVE-2026-45856

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-45856 · Security Note
• https://git.kernel.org/stable/c/bf4454da8b1e712714628c0a0d6e7845bb40790a · Note
• https://git.kernel.org/stable/c/1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0 · Note
• https://git.kernel.org/stable/c/bef70ff9841990658610512b4a18e4a88c9b4df6 · Note
• https://git.kernel.org/stable/c/9b5ac1c15334d46c0dbd49d64a2257b929500163 · Note
• https://git.kernel.org/stable/c/bf1feed1a7886af945f92890493aefd2b5c9928a · Note
• https://git.kernel.org/stable/c/9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7 · Note
• https://git.kernel.org/stable/c/d533425ac1f2925b4fc3e4ed9b9d72362cb23475 · Note
• https://git.kernel.org/stable/c/01c9b152647dc70dc06a4a2eff86ebb3b3c76075 · Note