Skip to main content

Linux Kernel CVE-2026-74297

| EUVDEUVD-2026-59444 HIGH
2026-08-15 Linux GHSA-p4jx-gh49-76wv
Buffer Overflow Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local user access on mlx5-equipped system
  2. Delivery
    Verify /dev/infiniband/uverbs* access is available
  3. Exploit
    Issue malformed RQ creation verb with rq_wqe_shift=31 or 32
  4. Execution
    Trigger signed integer overflow in set_rq_size()
  5. Persist
    Corrupt kernel memory via undefined behavior
  6. Impact
    Escalate privileges to root or crash kernel

Vulnerability Assessment

Exploitation Conditions

Exploitation requires two concurrent conditions: (1) the target system must have Mellanox/NVIDIA mlx5-series RDMA hardware (e.g., ConnectX-4 or later) physically installed with the mlx5_ib kernel module loaded and active; and (2) the attacker must hold a local user session with read-write access to an RDMA uverbs character device (/dev/infiniband/uverbs*), which is typically granted to members of a specific RDMA group or via manual permission grants - not available to arbitrary unprivileged users by default on most distributions. Remote exploitation is precluded by the AV:L vector. Systems running Linux without mlx5 RDMA hardware, or those where the mlx5_ib module is not loaded, are entirely unaffected. Root or administrative privileges are not required by the attacker beyond the RDMA device access described above.
Impact

The CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the kernel-level impact: a local user with RDMA device access and no special complexity requirements can trigger undefined behavior leading to full kernel compromise. However, real-world risk is substantially constrained by hardware dependency - exploitation is only possible on systems where Mellanox/NVIDIA mlx5 RDMA hardware is physically installed and the mlx5_ib module is loaded. EPSS at 0.18% (7th percentile) is very low, consistent with a kernel driver bug requiring specific hardware and local access rather than a broadly weaponizable network-facing flaw. The vulnerability is not listed in CISA KEV and no POC has been identified, reinforcing that this has not attracted active exploitation interest. For shared multi-tenant Linux environments with mlx5 hardware - primarily HPC clusters and high-throughput data center nodes - this represents a meaningful local privilege escalation risk from untrusted users. For the vast majority of Linux deployments without RDMA hardware, the attack surface does not exist. The CVSS vector and description are fully consistent with one another; no conflicting signals are present.
Exploit ScenarioDerived

A local user on a shared HPC cluster node equipped with a Mellanox ConnectX adapter opens /dev/infiniband/uverbs0 and invokes a userspace RDMA verb call to create a Receive Queue, supplying a crafted rq_wqe_shift value of 31 or 32. The kernel's set_rq_size() function computes '1 << rq_wqe_shift' on a signed 32-bit integer without overflow protection, producing undefined behavior that may corrupt adjacent kernel data structures depending on compiler optimization choices. This could allow the user to escalate to root privileges or trigger a kernel panic affecting all users of the system. No public POC exploit is known at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.

RemediationAI

Upgrade to a patched stable kernel release for the relevant branch: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. Individual stable commits for each branch are available at git.kernel.org - key hashes include 9fff54929cc00849d738faa99f06c32399aeb026, b746f949c2ac2b041102836095d6d4a2ef21fa75, c1dbf52d24a8cb1aa56780ba51b72e7d495f258c, 6fc874fdfb366bfb11c62e6af9a831c8be59ddda, 42f3d2c8c18b92ea33e506a38b64f1a8986c2823, 4b87a2497276a72fd63028e7419abf0fb7ed837b, b732db02a2b04cde393638df19de6251ce62a74e, and d881d60223aac8fdc12b227d89c76e131e92a9cd. For systems that cannot be immediately patched, restrict access to RDMA uverbs device nodes by tightening permissions on /dev/infiniband/uverbs* to trusted users only (e.g., removing world-readable access or limiting to a specific group). If RDMA functionality is not required, unloading the mlx5_ib kernel module eliminates the attack surface - note this will disable RDMA/InfiniBand functionality but should not affect Ethernet if mlx5_core is used independently. Systems without Mellanox mlx5 hardware require no action.

Affected VersionsENISA

Linux patch: 7.1.5
Linux patch: 5.10.261
Linux e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c <c1dbf52d24a8cb1aa56780ba51b72e7d495f258c
Linux e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c <b732db02a2b04cde393638df19de6251ce62a74e
Linux e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c <d881d60223aac8fdc12b227d89c76e131e92a9cd
Linux e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c <6fc874fdfb366bfb11c62e6af9a831c8be59ddda
Linux e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c <42f3d2c8c18b92ea33e506a38b64f1a8986c2823
Linux e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c <9fff54929cc00849d738faa99f06c32399aeb026
Linux 3.11
Linux patch: 6.1.178
Linux patch: 6.18.40
Linux patch: 6.6.145
Linux patch: 5.15.212
Linux e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c <b746f949c2ac2b041102836095d6d4a2ef21fa75
Linux patch: 7.2-rc1
Linux e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c <4b87a2497276a72fd63028e7419abf0fb7ed837b
Linux patch: 6.12.97
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the RDMA/mlx5 kernel subsystem, which drives Mellanox (now NVIDIA) ConnectX network adapters supporting Remote Direct Memory Access over InfiniBand and RoCE protocols. The function set_rq_size() computes the Receive Queue (RQ) Work Queue Element (WQE) size using the expression '1 << rq_wqe_shift', where rq_wqe_shift is a value supplied directly from userspace. Input validation only rejected values strictly greater than 32, meaning rq_wqe_shift=32 was silently accepted. Left-shifting a signed 32-bit integer by 31 or 32 bits violates C language guarantees - shifting into or past the sign bit constitutes undefined behavior (ISO C99 §6.5.7), allowing compilers to produce unpredictable results including memory corruption. The fix applies the kernel's check_shl_overflow() helper, which performs the computation safely and explicitly rejects any shift value that would overflow. Though no CWE is formally assigned by NVD, this maps to CWE-190 (Integer Overflow or Wraparound) and CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior). The EUVD identifier EUVD-2026-59444 traces the introduction to commit e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local vector confirmed by RDMA device access requirement; PR:L because device access is not root but is a restricted group permission; high C/I/A reflects potential kernel memory corruption and privilege escalation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:58 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix undefined shift of user RQ WQE size

set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior.

Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values.

Executive ViewAI

Why It Matters

Mellanox ConnectX RDMA hardware running affected Linux kernel versions is vulnerable to local privilege escalation (CVE-2026-74297, CVSS 7.8), potentially exposing systems to unauthorized administrative access or service disruptions. No public exploit identified at time of analysis, allowing organizations to remediate without responding to active attacks. A vendor-released patch is available, enabling straightforward remediation within standard maintenance windows.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Medium
common in HPC and data center environments with Mellanox/NVIDIA RDMA hardware
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74297 ADVISORY https://ubuntu.com/security/notices/USN-8876-1 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 REF https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823 REF https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b REF https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda REF https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026 REF https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e REF https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75 REF https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c REF https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy