CVE-2026-53187

A flaw was found in the Linux kernel's RDMA/core component. A local attacker could supply an invalid cpu_id through the UVERBS_ATTR_ALLOC_DMAH_CPU_ID attribute without proper validation. This improper validation could lead to an out-of-bounds read of the cpumask bitmap. On systems configured with CONFIG_DEBUG_PER_CPU_MAPS and panic_on_warn, this vulnerability could result in a system reboot, leading to a denial of service.

An out-of-bounds read can occur in the RDMA DMAH allocation path because a user supplied cpu_id is passed to cpumask_test_cpu without checking it against nr_cpu_ids. The helper can index past the valid cpumask bitmap and on kernels with CONFIG_DEBUG_PER_CPU_MAPS it can also trigger a WARN path that becomes a system reboot when panic_on_warn is enabled. For the CVSS the PR:L is used because a local process needs access to the RDMA uverbs device interface, but full administrator privileges are not necessarily required in deployments that grant RDMA device access to users or service accounts. The issue is not directly network reachable and is triggered through a local device ioctl style control path. Impact is primarily denial of service, with only limited confidentiality concern from the invalid read and no clear integrity or privilege escalation primitive shown by the code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.