CVE-2026-74394

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/srpt: fix integer overflow in immediate data length check<br /> <br /> imm_buf-&gt;len is a user-controlled uint32_t received from the network.<br /> Adding it to imm_data_offset without overflow checking allows a<br /> malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap<br /> around to a small value, bypassing the bounds check, and subsequently<br /> passing a ~4GB length to sg_init_one().<br /> <br /> Use check_add_overflow() to detect wrapping before the comparison.