CVE-2026-74394: critical vulnerability in Linux
RDMA/srpt: fix integer overflow in immediate data length check
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.5%
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Linux · LinuxRelated CVEs — Linux
In the same product, most dangerous first.
CVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 98.1%KEVCVE-2026-46300HIGHnet: skbuff: preserve shared-frag marker during coalescingEPSS 16.1%KEVCVE-2024-53197HIGHALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesEPSS 4.1%KEVCVE-2024-53104HIGHmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatEPSS 3.4%KEVCVE-2025-39682CRITICALtls: fix handling of zero-length records on the rx_listEPSS 3.3%KEVCVE-2024-36971HIGHnet: fix __dst_negative_advice() raceEPSS 2.7%KEV
References
https://git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418fhttps://git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8ehttps://git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49https://git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aafhttps://git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921https://git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7dhttps://git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91https://git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796