CVE-2026-74378

A flaw was found in the Linux kernel's RDMA/rxe component. A Time-of-check to time-of-use (TOCTOU) vulnerability exists where a user-space thread can modify the num_sge value after it has been validated but before it is used to calculate a memory copy size. This allows a local attacker to trigger a heap buffer overflow when copying a Work Queue Entry (WQE), potentially leading to a denial of service or arbitrary code execution.

This vulnerability is rated as Moderate impact because successful exploitation requires local user privileges, an active Soft-RoCE RDMA configuration, and winning a precise timing window to modify memory during queue processing. The Soft-RoCE (rdma_rxe) kernel driver is not loaded or configured by default on Red Hat Enterprise Linux installations. Consequently, systems are only exposed if RDMA software emulation interfaces have been explicitly deployed and made accessible to untrusted local users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.