Heimdall Security Logo

CVE-2026-74346

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, 7.1.5, 6.18.40, <=6.12.*, 7.2, 0, <54cab78df0375196aaec4e3109191653d21751df, <=7.1.*, <5.14, 6.1.178, b48c24c2d710cf34810c555dcef883a3d35a9c08, 6.12.97, <=6.6.*, 5.14, <3159c6fac43dc24b34d31971884d98a7a1bf4c4b, <d5aa82da8f65562da996d184686db9d0ea718b91, <=6.18.*, 5.15.212, 6.6.145, <a80b3b13786e9ab1c52b31a1f16c7d6708fa9220, <4385ddd654d90245eeb83b3cb539670ab5c85ba4, <=*, <=5.15.*, <ad360a31092a870633ec255b96f50181628b4de0, <d566002de555b18cc395012c5c1cb8682fc6d2a9

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one.

Gravité et risque d'exploitation

CVE-2026-74346 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.17 %, ce qui la place devant 6.3 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, 7.1.5, 6.18.40, <=6.12.*, 7.2, 0, <54cab78df0375196aaec4e3109191653d21751df, <=7.1.*, <5.14, 6.1.178, b48c24c2d710cf34810c555dcef883a3d35a9c08, 6.12.97, <=6.6.*, 5.14, <3159c6fac43dc24b34d31971884d98a7a1bf4c4b, <d5aa82da8f65562da996d184686db9d0ea718b91, <=6.18.*, 5.15.212, 6.6.145, <a80b3b13786e9ab1c52b31a1f16c7d6708fa9220, <4385ddd654d90245eeb83b3cb539670ab5c85ba4, <=*, <=5.15.*, <ad360a31092a870633ec255b96f50181628b4de0, <d566002de555b18cc395012c5c1cb8682fc6d2a9) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE