CVE-2026-45856

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the ib_uverbs_post_send function. A local user can exploit this vulnerability by providing an invalid work queue element size (wqe_size) from userspace without proper validation. This can lead to an out-of-bounds read from kernel heap memory, potentially disclosing sensitive kernel information to the user. Additionally, an excessively large wqe_size could trigger a kernel warning.

This vulnerability is evaluated as Moderate severity because exploitation requires local user access and privileges to interact with RDMA device nodes, restricting the potential impact to kernel memory disclosure or localized denial of service. The flaw arises from missing validation on user-supplied request buffer dimensions in the user-space RDMA interface, which allows out-of-bounds memory reads from the kernel heap. Systems that do not utilize InfiniBand or RoCE hardware or do not load the corresponding user-verbs modules do not expose the vulnerable code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.