Unrated severityNVD Advisory· Published May 27, 2026· Updated May 27, 2026

CVE-2026-45856

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr.

If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace.

Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller.

This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding.

Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's RDMA/uverbs, ib_uverbs_post_send() lacks validation of wqe_size from userspace, leading to out-of-bounds read or memory allocation warnings.

Vulnerability

The Linux kernel's RDMA subsystem in ib_uverbs_post_send() (drivers/infiniband/core/uverbs_main.c) does not validate the wqe_size field provided by userspace before using it in kmalloc() and accessing the allocated buffer as struct ib_uverbs_send_wr. This affects kernel versions prior to the fix commit [1]. The function ib_uverbs_unmarshall_recv() already validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr), but the send path lacked equivalent checks.

Exploitation

An attacker with local access and the ability to invoke the IB_USER_VERBS_CMD_POST_SEND ioctl can supply a crafted wqe_size value. A small value (e.g., 1) causes kmalloc() to succeed but subsequent reads of user_wr->opcode, user_wr->num_sge, etc. go beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. An excessively large value can trigger a WARNING in the memory allocation path.

Impact

Successful exploitation could lead to disclosure of sensitive kernel heap memory to userspace via the out-of-bounds read. The attacker may obtain information that could aid in further privilege escalation. The vulnerability does not directly allow code execution or privilege escalation, but information leakage is a serious concern.

Mitigation

The fix was committed to the Linux kernel stable tree in commit bef70ff9841990658610512b4a18e4a88c9b4df6 [1]. Users should apply the patch or update to a kernel version containing this fix. No workaround is available; the vulnerability is fixed by validating wqe_size >= sizeof(struct ib_uverbs_send_wr).

References

Making sure you're not a bot!

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

Linux/Kernelllm-fuzzy

Patches

d533425ac1f2

RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitYi LiuJan 22, 2026Fixed in 6.12.75via kernel-cna

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Vulnerability

Exploitation

Impact

Mitigation

Root cause

Attack vector

Affected code

What the fix does

Preconditions