CVE-2026-92525

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the RDMA/rxe component where the num sge and cur sge variables are not validated before indexing the wqe->dma.sge[] array. For user Queue Pairs (QP), the rxe post send() function schedules a send task without validating the Work Queue Element (WQE). Subsequently, the rxe requester() function consumes the WQE via req next wqe() and calls copy data(), which uses the attacker-controlled num sge and cur sge to index the array. This allows a local unprivileged user to provide an out-of-range cur sge or an oversized num sge, leading to a vmalloc out-of-bounds read in the copy data() function, which can result in a local Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.