CVE-2026-53187: Linux Kernel RDMA Out-of-Bounds Read Vulnerability

Technical summary

CVE-2026-53187 is an out-of-bounds read vulnerability in the Linux kernel RDMA/core module affecting DMAH (DMA-able memory) allocation. The vulnerability stems from the UVERBS_ATTR_ALLOC_DMAH_CPU_ID attribute accepting user-space input without validating it against nr_cpu_ids before passing it to cpumask_test_cpu(). Since cpumask_test_cpu() expands to test_bit() which indexes the bitmap as cpu_id / BITS_PER_LONG without bounds checking, an attacker can craft a cpu_id value that reads arbitrary offsets in kernel memory. The issue is compounded on kernels with CONFIG_DEBUG_PER_CPU_MAPS enabled, where cpumask_check() triggers a WARN_ON_ONCE() condition that can cause kernel panic when panic_on_warn is set, converting a memory disclosure into a denial of service.

Business impact

This vulnerability enables local privilege escalation and denial-of-service attacks on Linux systems with RDMA capabilities enabled. An attacker with unprivileged local access can leak kernel memory contents (potentially exposing cryptographic keys, addresses for ASLR bypass, or other sensitive data) or force a system crash. For organizations running HPC clusters, InfiniBand networks, or other RDMA-dependent infrastructure, this represents a significant availability and confidentiality risk. The combination of information disclosure and crash capability makes this particularly concerning for multi-tenant environments where one container or VM could attack the host or sibling instances.

Affected systems

The Linux kernel is affected across multiple versions. Systems must have RDMA/InfiniBand support enabled and exposed to untrusted users to be at risk. This includes HPC clusters, cloud providers offering bare-metal or shared-memory instances, and enterprise systems with iWARP, RoCE, or InfiniBand adapters. The vulnerability is most dangerous when unprivileged user namespaces are enabled, as it allows local attackers to interact with UVERBS (User-Verb) interfaces. Verify your specific kernel version against vendor security advisories and your RDMA configuration to determine exposure.

Exploitability

Exploitability is moderate to high for affected environments. The attack requires local system access and the ability to invoke UVERBS DMAH allocation calls, which are typically restricted to users with appropriate capabilities. However, unprivileged user namespace creation (CONFIG_USER_NS_UNPRIVILEGED) lowers this barrier significantly. No public exploit code is known at this time, but the vulnerability is straightforward to exploit once preconditions are met—an attacker simply passes an out-of-range cpu_id via the UVERBS interface. Systems with panic_on_warn enabled convert this to immediate denial of service. The CVSS 3.1 score of 7.1 (HIGH) reflects local attack vector, low attack complexity, and high impact on both confidentiality and availability.

Remediation

Apply a kernel patch that validates cpu_id against nr_cpu_ids before it reaches cpumask_test_cpu(). The fix involves adding a bounds check in the DMAH allocation code path to reject any cpu_id >= nr_cpu_ids with -EINVAL. For immediate mitigation on systems where patching is delayed, restrict unprivileged user namespace creation via sysctl (kernel.unprivileged_userns_clone = 0) to reduce the attack surface. Disable panic_on_warn if not operationally necessary. Audit UVERBS access controls to ensure only trusted users can trigger DMAH operations.

Patch guidance

Check with your Linux distribution (Red Hat, Canonical, SUSE, etc.) for patched kernel versions addressing this vulnerability. Verify against the vendor's security advisory that the specific patch validating cpu_id bounds is included. The fix is minimal and carries low regression risk. Testing should confirm that legitimate DMAH allocations with valid CPU IDs continue to function, and that invalid cpu_ids are correctly rejected with EINVAL. Prioritize patching for systems exposing RDMA to untrusted users or running in multi-tenant environments.

Detection guidance

Monitor system logs for UVERBS DMAH allocation failures with EINVAL returns, which may indicate exploitation attempts. On kernels with CONFIG_DEBUG_PER_CPU_MAPS, check kernel logs for cpumask_check() warnings immediately preceding crashes or watchdog resets, as these suggest out-of-range cpu_id calls. Audit unprivileged user namespace activity on systems where this is enabled; attackers typically create a new namespace before invoking UVERBS calls. Network-based detection is difficult; focus on host-based endpoint detection and response (EDR) rules watching for user processes calling UVERBS ioctls with unusual parameters.

Why prioritize this

Prioritize patching for systems that meet multiple risk factors: (1) RDMA/InfiniBand hardware or software stack is enabled and accessible, (2) unprivileged user namespaces are permitted, (3) multi-tenant or shared-user environment, (4) panic_on_warn is enabled. For single-user or tightly controlled systems without RDMA exposure, risk is lower but not eliminated. The HIGH CVSS score combined with local attack vector and dual impact (confidentiality + availability) makes this a medium-to-high priority across most datacenter and HPC environments.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) is assigned based on: (1) Attack Vector: Local—attacker needs system access; (2) Attack Complexity: Low—no special conditions required once preconditions are met; (3) Privileges Required: Low—unprivileged users can exploit on systems with user namespaces; (4) User Interaction: None; (5) Scope: Unchanged; (6) Confidentiality Impact: High—out-of-bounds memory read leaks kernel data; (7) Integrity Impact: None—no data corruption; (8) Availability Impact: High—kernel panic possible via panic_on_warn. The score appropriately reflects the practical risk to multi-tenant infrastructure.

Frequently asked questions