CVE-2026-74390

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write exists in the irdma copy user pgaddrs() function. The function iterates through umem DMA blocks to populate PBLEs, stopping when it reaches the last DMA block or when palloc->total cnt is reached. However, the logic for checking palloc->total cnt fails when the value is zero. Specifically, when irdma setup pbles() is called with lvl==0, it invokes irdma copy user pgaddrs() with palloc->total cnt==0, potentially causing the loop to exceed the fixed size of the iwmr->pgaddrmem array. For QP, CQ, and SRQ rings, where lvl is determined by separate inputs such as req.cq pages, a lack of explicit checking can lead to an overflow of the pgaddrmem array if the provided umem contains more blocks than the specified req.cq pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.