CVE-2026-45856 Details

A vulnerability exists in the Linux kernel's RDMA/uverbs component, specifically within the ib_uverbs_post_send() function. This issue arises because the function uses the wqe_size parameter from userspace without proper validation before allocating memory with kmalloc(). As a result, a user could provide a small wqe_size value, such as 1, which would be accepted by kmalloc(). However, this would lead to an out-of-bounds read from the kernel heap, as subsequent accesses to certain fields would exceed the allocated buffer. This vulnerability could potentially leak sensitive kernel information to userspace. Furthermore, an excessively large wqe_size could trigger a warning in the memory allocation process, as noted by syzkaller. This lack of validation is inconsistent with ib_uverbs_unmarshall_recv(), which correctly checks that wqe_size is greater than or equal to the size of struct ib_uverbs_recv_wr() before proceeding.

The vulnerability has been addressed by adding proper validation for the wqe_size parameter in the ib_uverbs_post_send() function. Users should update to the latest version of the Linux kernel where this fix has been applied.