CVE-2026-74297

A flaw was found in the Linux kernel's RDMA/mlx5 subsystem. Insufficient validation of a user-provided input, rq_wqe_shift, in the set_rq_size() function can lead to an integer overflow. This overflow results in an undefined shift operation, which may cause system instability or a denial of service.

An undefined left shift in the RDMA mlx5 userspace QP creation path can occur because set_rq_size computes the RQ WQE size from a user controlled rq_wqe_shift value. Values such as 31 or 32 can overflow or exceed the valid signed shift range and may produce an invalid WQE size or an inconsistent max_gs value. For the CVSS the PR:L is used because reliable triggering requires local access to the RDMA uverbs device, but this access can be available to non root users through an rdma group or a service account. The issue is not directly network reachable and requires local interaction with the RDMA device interface. Base impact is likely local denial of service or invalid queue setup. Impact may include limited confidentiality or integrity impact if the bad size calculation reaches later queue or WQE handling code, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.