CVE-2026-45856

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

ib_uverbs_post_send() uses cmd.wqe_size from userspace without any

validation before passing it to kmalloc() and using the allocated

buffer as struct ib_uverbs_send_wr.

If a user provides a small wqe_size value (e.g., 1), kmalloc() will

succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge,

and other fields will read beyond the allocated buffer, resulting in

an out-of-bounds read from kernel heap memory. This could potentially

leak sensitive kernel information to userspace.

Additionally, providing an excessively large wqe_size can trigger a

WARNING in the memory allocation path, as reported by syzkaller.

This is inconsistent with ib_uverbs_unmarshall_recv() which properly

validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before

proceeding.

Add the same validation for ib_uverbs_post_send() to ensure wqe_size

is at least sizeof(struct ib_uverbs_send_wr).