CVE-2026-53133: Linux RDMA DMA Address Truncation Vulnerability

Technical summary

CVE-2026-53133 is a truncation vulnerability in the Linux kernel's RDMA/umem subsystem, specifically in the __rdma_block_iter_next() function. When an IOMMU linearizes scatter-gather (SG) entries into large DMA blocks, the function uses 32-bit stack values to reassemble split SG entries. For blocks >= 4 GB, these 32-bit integers overflow, resulting in incorrect DMA address calculations for subsequent blocks. The root cause is a type mismatch—the code fails to use proper DMA address types (typically 64-bit) capable of holding the full address space. This allows attacks to map RDMA operations to unintended memory locations.

Business impact

Organizations running Linux kernel-based systems with RDMA hardware and IOMMU enabled face a significant risk. Compromised DMA address calculations could allow an attacker with local access to read sensitive data from kernel or other processes' memory, modify memory structures, or trigger kernel panics. In cloud environments, container isolation and hypervisor security boundaries may be circumvented. Database servers, HPC clusters, and storage appliances using RDMA are particularly affected if they permit untrusted local users to access RDMA capabilities.

Affected systems

All versions of the Linux kernel prior to the fix are affected. This includes current stable kernels (6.x series) and long-term support versions. The vulnerability requires an IOMMU to be present and enabled, which is common in modern server and datacenter hardware, and RDMA capabilities to be exposed or accessible to local users. Systems without RDMA or IOMMU functionality are not at risk.

Exploitability

Exploitation requires local access and the ability to initiate RDMA operations—either directly or through container/VM escape. The vulnerability is not network-exploitable. An attacker with unprivileged local user privileges can trigger the bug if RDMA is accessible to their privilege level. The lack of CVSS authentication requirement (PR:L) and complexity factors indicate a relatively straightforward exploitation path for local users in multi-tenant or shared-access environments.

Remediation

Apply kernel patches that correct the type definitions used in __rdma_block_iter_next() to properly handle 64-bit DMA addresses. Verify patching against the upstream Linux kernel repository and your distribution's advisory for confirmation of fixed versions. Interim mitigation includes restricting RDMA access through LSM policies, disabling RDMA if unused, or limiting exposure in multi-tenant environments.

Patch guidance

Monitor your Linux distribution's security advisories for patched kernel versions. Upstream fixes are available in the Linux kernel development tree. Verify the patch directly addresses the 32-bit truncation in __rdma_block_iter_next() and uses correct DMA address types. Apply patches during a planned maintenance window, as kernel updates typically require a system reboot. Prioritize systems with IOMMU-enabled hardware and exposed RDMA interfaces.

Detection guidance

Monitor system logs for RDMA-related errors, memory access violations, or unexpected DMA mappings. Kernel debugging tools such as ftrace can track DMA address assignments in the RDMA/umem code path. Check for unexpected IOMMU page faults or address translation failures correlated with RDMA operations. On affected systems, observe whether applications using RDMA over large memory blocks experience crashes or data corruption. Network-based detection is not applicable; focus on endpoint telemetry and kernel audit logs.

Why prioritize this

This vulnerability warrants HIGH priority due to its direct impact on memory safety and the privilege boundary. The CVSS 7.8 score reflects high confidentiality and integrity impact. Although local-only access is required, the accessibility of RDMA in cloud and multi-tenant Linux environments increases practical risk. Organizations operating HPC clusters, database services, or container platforms should prioritize patching systems where RDMA is enabled or accessible to untrusted users.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L) — requires local user access; Attack Complexity Low (AC:L) — straightforward exploitation once access is gained; Privileges Required Low (PR:L) — unprivileged user can trigger; User Interaction None (UI:N) — no user action needed; Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H) — successful exploitation can read, modify, or crash memory. The scope is Unchanged (S:U), meaning the impact is confined to the affected component but affects core memory safety.

Frequently asked questions