CVE-2026-53186

kernel: RDMA/srp: bound SRP_RSP sense copy by the received length

Loading…

Severity

Moderate

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · June 25, 2026

Updated · October 20, 2026

Description

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) SCSI RDMA Protocol (SRP) component. A malicious or compromised SRP target on the InfiniBand/RoCE fabric can exploit this vulnerability by sending a specially crafted SRP response with an excessively large data length. This can lead to an out-of-bounds read when processing sense data, causing read faults and potentially a denial of service (DoS) on the system.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-130 · Improper Handling of Length Parameter Inconsistency