CVE-2026-74346

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) irdma component. During Completion Queue (CQ) Memory Region (MR) registration, an internal field was not correctly initialized. This could lead to an out-of-bounds read when handling queue memory, potentially allowing an attacker to access sensitive information or cause system instability.

An OOB read in RDMA irdma CQ memory registration occurs because cqmr split is false during MR registration even when the device supports CQ resize. For GEN_2 hardware and later, req cq_pages can be equal to the allocated arr size, so reading arr(req cq_pages) reads one entry past the array while populating the CQ shadow address. For the CVSS the PR:L is used because practical triggering requires a local process that can access RDMA verbs or uverbs and create CQs on an affected irdma device. The issue is not directly network reachable because the vulnerable path is a local RDMA control path rather than packet processing. Impact is mainly a local driver memory safety issue with possible limited information exposure or instability, and it should be reviewed manually due to the kernel OOB read primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.