CVE-2026-74297 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix undefined shift of user RQ WQE size
set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior.
Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's RDMA/mlx5 driver component which handles Mellanox InfiniBand and Ethernet network adapters. This issue resides within the set_rq_size() function that processes user-provided parameters for receive queue work queue elements. The flaw stems from inadequate input validation where the driver accepts a user-supplied rq_wqe_shift parameter without proper bounds checking, creating a potential pathway for undefined behavior exploitation.
The technical implementation of this vulnerability occurs when the system computes the RQ WQE size using bit shifting operations with the formula "1 << rq_wqe_shift". While the code does validate that the shift value exceeds 32, it fails to reject values of exactly 32 or values that would cause signed integer overflow such as a shift of 31. This oversight creates undefined behavior conditions when the compiler processes these invalid shift operations, potentially leading to memory corruption or arbitrary code execution.
This vulnerability impacts systems utilizing Mellanox RDMA hardware and can be exploited by malicious users who gain the ability to control the rq_wqe_shift parameter. The operational consequences include potential denial of service through system crashes or more severe exploitation leading to privilege escalation. Attackers could leverage this flaw in environments where untrusted users have access to RDMA operations, making it particularly concerning for cloud computing and data center deployments where such access might be granted.
The fix addresses this issue by implementing proper overflow checking using the check_shl_overflow() function which properly validates shift operations before computation. This approach aligns with common security practices for preventing integer overflow vulnerabilities as classified under CWE-194 in the Common Weakness Enumeration catalog and follows mitigation strategies recommended in the MITRE ATT&CK framework for kernel-level privilege escalation techniques. The solution ensures that any invalid shift values are rejected before processing, preventing the undefined behavior that could lead to system compromise.
The remediation approach demonstrates proper defensive programming practices where input validation occurs at the point of computation rather than relying on assumptions about parameter ranges. This fix prevents potential exploitation paths that could be leveraged by attackers in privileged code execution contexts, particularly relevant for environments where RDMA operations might be exposed to untrusted users or processes. The implementation follows established kernel security guidelines and helps maintain system integrity in high-performance networking scenarios.