CVE-2026-74394

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check immbuf-len is a user-controlled uint32t received from the network. Adding it to immdataoffset without overflow checking allows a malicious initiator to send...

CVE-2026-74390

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdmacopyuserpgaddrs The irdmacopyuserpgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc-totalc...

CVE-2026-74377

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

CVE-2026-74378

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validates numsge against maxsge, but then re-reads the same field to calculat...

AZL-96228 CVE-2026-74345 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

CVE-2026-74345

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

CVE-2026-74334

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...

AZL-96486 CVE-2026-74334 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...

CVE-2026-74297

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size setrqsize computes the RQ WQE size as "1 rqwqeshift" based on the user-provided rqwqeshift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shi...

CVE-2026-74298

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails...

CVE-2026-74299

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR aging push to queue error flow Aging pools with pinned handles requires moving handles from the active queue to a non-empty inactive queue that might fail on new page allocation, we are currently not handling...

CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-72498

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

CVE-2026-72497

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than t...

CVE-2026-72499

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

AZL-96009 CVE-2026-72501 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...

CVE-2026-72501

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...

AZL-96081 CVE-2026-72495 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check to...

CVE-2026-72494

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barriers around requestdone. An earlier patch by Gui-Dong Han attempted to...

CVE-2026-72491

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma-state in transrdma.c The rdma-state field is modified without holding reqlock in both recvdone and p9cmeventhandler, while rdmarequest accesses the same field under the reqlock spinlock. This...