CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

ib_uverbs_post_send() uses cmd.wqe_size from userspace without any
validation before passing it to kmalloc() and using the allocated
buffer as struct ib_uverbs_send_wr.

If a user provides a small wqe_size value (e.g., 1), kmalloc() will
succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge,
and other fields will read beyond the allocated buffer, resulting in
an out-of-bounds read from kernel heap memory. This could potentially
leak sensitive kernel information to userspace.

Additionally, providing an excessively large wqe_size can trigger a
WARNING in the memory allocation path, as reported by syzkaller.

This is inconsistent with ib_uverbs_unmarshall_recv() which properly
validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before
proceeding.

Add the same validation for ib_uverbs_post_send() to ensure wqe_size
is at least sizeof(struct ib_uverbs_send_wr).

The Linux kernel CVE team has assigned CVE-2026-45856 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 5.10.252 with commit 9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7
	Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 5.15.202 with commit 9b5ac1c15334d46c0dbd49d64a2257b929500163
	Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.1.165 with commit 01c9b152647dc70dc06a4a2eff86ebb3b3c76075
	Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.6.128 with commit bf1feed1a7886af945f92890493aefd2b5c9928a
	Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.12.75 with commit d533425ac1f2925b4fc3e4ed9b9d72362cb23475
	Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.18.14 with commit bf4454da8b1e712714628c0a0d6e7845bb40790a
	Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 6.19.4 with commit bef70ff9841990658610512b4a18e4a88c9b4df6
	Issue introduced in 5.0 with commit c3bea3d2dc5358e05541527283279102383b0231 and fixed in 7.0 with commit 1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-45856
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/infiniband/core/uverbs_cmd.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7
	https://git.kernel.org/stable/c/9b5ac1c15334d46c0dbd49d64a2257b929500163
	https://git.kernel.org/stable/c/01c9b152647dc70dc06a4a2eff86ebb3b3c76075
	https://git.kernel.org/stable/c/bf1feed1a7886af945f92890493aefd2b5c9928a
	https://git.kernel.org/stable/c/d533425ac1f2925b4fc3e4ed9b9d72362cb23475
	https://git.kernel.org/stable/c/bf4454da8b1e712714628c0a0d6e7845bb40790a
	https://git.kernel.org/stable/c/bef70ff9841990658610512b4a18e4a88c9b4df6
	https://git.kernel.org/stable/c/1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0