{"apiVersion":"1.0","identifier":"CVE-2026-74378","description":"In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe. Read num_sge into a local variable and use it for both the bounds check and the size calculation.","publishedAt":"2026-08-15T06:22:39","lastModifiedAt":"2026-08-17T06:19:32","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74378","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00143,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74378","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74378","en":"https://www.redsauce.net/en/cves/CVE-2026-74378","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74378","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74378","de":"https://www.redsauce.net/de/cves/CVE-2026-74378","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74378","el":"https://www.redsauce.net/el/cves/CVE-2026-74378"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74378"}}