CVE-2026-45856

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Validate wqesize before using it in ibuverbspostsend

ibuverbspostsend() uses cmd.wqesize from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ibuverbssend_wr.

If a user provides a small wqesize value (e.g., 1), kmalloc() will succeed, but subsequent accesses to userwr->opcode, userwr->numsge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace.

Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller.

This is inconsistent with ibuverbsunmarshallrecv() which properly validates that wqesize >= sizeof(struct ibuverbsrecv_wr) before proceeding.

Add the same validation for ibuverbspostsend() to ensure wqesize is at least sizeof(struct ibuverbssend_wr).