CVE-2026-74377

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path

For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxerespchecklength() and copy_data().

Introduce getrecvwqe() that validates numsge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in getsrqwqe(). The srqwqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP.