CVE-2026-74394

CVE-2026-74394 is an integer overflow in the RDMA srpt driver where a uint32_t length field from an untrusted network initiator flows directly into arithmetic without overflow checking. The fix is a single call to check_add_overflow()—demonstrably trivial once identified. The real problem is that it took eleven years to identify. The srpt driver receives a length field from network fabric and performs arithmetic with it. When the attacker wraps the value, sg_init_one() receives a request size of approximately 4GB instead of the intended small allocation, causing heap corruption or allocation failure with controllable characteristics. The critical detail: this isn't a typical kernel bug with moderate blast radius. RDMA operates at a privilege level that bypasses normal memory protections—direct physical memory access means the exploitation pathway doesn't require chaining additional bugs. One overflow, one primitive, direct kernel memory corruption. The eleven-year gap between check_add_overflow()'s 2015 introduction and this CVE isn't historical accident—it's evidence that safe APIs don't propagate through organic adoption. The srpt driver wasn't written yesterday; it was touched repeatedly over the past decade by developers who weren't triggered to notice the pattern because their review context was fabric protocol correctness, not scalar overflow. Each modification was an opportunity that never materialized. Your action items: First, audit RDMA subsystem code for unchecked arithmetic on protocol-derived values—other handlers likely harbor the same pattern. Second, if you maintain kernel build infrastructure, treat unchecked unsigned addition on network-sourced values as a warning category worth flagging at commit time, similar to how lockdep instruments locking patterns. Third, recognize that stable drivers acquire immunity to scrutiny precisely because they work—legacy arithmetic patterns in drivers marked 'stable' are worth auditing specifically because they've escaped attention for years.

Reviewed through automated stages and approved by a human before publication.