CVE-2026-74378

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim's userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.

AC:LAttack complexity, low

The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap'd SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.

PR:LPrivileges required, low

An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap'd queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via "rdma link add type rxe" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).

UI:NUser interaction, none

No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.

S:UScope, unchanged

The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.

C:HConfidentiality impact, high

The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap'd SRQ ring buffer and overflows the fixed qp->resp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.

I:HIntegrity impact, high

Overflowing qp->resp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.

A:HAvailability impact, high

Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state.