CVE-2026-74378

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) issue exists in the RDMA/rxe component. The function get srq wqe() reads the num sge variable from a shared receive queue buffer mapped into userspace. Although the function validates num sge against max sge, it subsequently re-reads the same field to determine the size for a memcpy operation. A concurrent userspace thread can modify num sge between the validation and the actual use, leading to a heap buffer overflow when copying the Work Queue Element (WQE) into qp->resp.srq wqe.

Recommendations Read the num sge variable into a local variable and use that local copy for both the bounds check and the size calculation.