---
id: CVE-2026-74390
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

  The irdma_copy_user_pgaddrs function loops through all of the umem DMA
  blocks to populate the PBLEs and …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

  The irdma_copy_user_pgaddrs function loops through all of the umem DMA
  blocks to populate the PBLEs and …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    4780f58672ee6328accd54a95f9c00683477e499
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    79a20a8e201a779224b4bf115250a7713bde72c0
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    9f8f0d2099e3de1194e37dc933ae0c4206b09aaf
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    192a3be0e3759daa24af2841208b074ca6dbaabc
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    424d51d33c7541a86934067c2c0538124687fc90
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    abd27a977b419d584efa659488c22d2306987b29
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    5ebb3ed757be3e04cf803026004aa0beaeb13e9b
  - Linux 5.14
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:24.820'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74390'
references:
  - url: 'https://git.kernel.org/stable/c/192a3be0e3759daa24af2841208b074ca6dbaabc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/424d51d33c7541a86934067c2c0538124687fc90'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4780f58672ee6328accd54a95f9c00683477e499'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5ebb3ed757be3e04cf803026004aa0beaeb13e9b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/79a20a8e201a779224b4bf115250a7713bde72c0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9f8f0d2099e3de1194e37dc933ae0c4206b09aaf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/abd27a977b419d584efa659488c22d2306987b29'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.0013
epssPercentile: 0.02579
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:55:16.364309Z'
ingestedAt: '2026-10-16T19:46:24.369Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

The irdma_copy_user_pgaddrs function loops through all of the umem DMA
blocks to populate the PBLEs and will stop when either the last DMA
block is reached or palloc->total_cnt is reached. The issue is that
the logic for checking palloc->total_cnt would only work for non-zero
values.

When irdma_setup_pbles is called with lvl==0, it
calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means
the only way to break out of the loop is to reach the last umem DMA
block, which means it could end up going beyond the fixed size of 4
iwmr->pgaddrmem array that is used in the lvl==0 case.

In the case of QP/CQ/SRQ rings, the value of lvl is determined by a
separate input (for example, req.cq_pages in the case of a CQ). So,
we must perform explicit checking to ensure we don't overflow the
pgaddrmem array if the user provides a umem that consists of more
blocks than their provided req.cq_pages.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.