In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00186.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
References
Link Providers
https://git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418f cve-icon cve-icon
https://git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e cve-icon cve-icon
https://git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49 cve-icon cve-icon
https://git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aaf cve-icon cve-icon
https://git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921 cve-icon cve-icon
https://git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d cve-icon cve-icon
https://git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91 cve-icon cve-icon
https://git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796 cve-icon cve-icon
History

Sat, 15 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-680

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison.
Title RDMA/srpt: fix integer overflow in immediate data length check
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:59:07.144Z

Reserved: 2026-08-15T05:44:03.891Z

Link: CVE-2026-74394

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:41.363

Modified: 2026-08-15T06:22:41.363

Link: CVE-2026-74394

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T13:30:04Z