CVE-2026-45856

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

ib_uverbs_post_send() uses cmd.wqe_size from userspace without any

validation before passing it to kmalloc() and using the allocated

buffer as struct ib_uverbs_send_wr.

If a user provides a small wqe_size value (e.g., 1), kmalloc() will

succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge,

and other fields will read beyond the allocated buffer, resulting in

an out-of-bounds read from kernel heap memory. This could potentially

leak sensitive kernel information to userspace.

Additionally, providing an excessively large wqe_size can trigger a

WARNING in the memory allocation path, as reported by syzkaller.

This is inconsistent with ib_uverbs_unmarshall_recv() which properly

validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before

proceeding.

Add the same validation for ib_uverbs_post_send() to ensure wqe_size

is at least

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References