CVE-2026-53186

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53186", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.390Z", "datePublished": "2026-06-25T08:38:59.508Z", "dateUpdated": "2026-10-19T19:57:27.012Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:33:53.227Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: bound SRP_RSP sense copy by the received length\n\nsrp_process_rsp() copies sense data from rsp->data + resp_data_len,\nwhere resp_data_len is the full 32-bit value supplied by the SRP target\nand is never checked against the number of bytes actually received\n(wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so\nat most 96 bytes are copied, but the source offset is not bounded.\n\nA malicious or compromised SRP target on the InfiniBand/RoCE fabric that\nthe initiator has logged into can return an SRP_RSP with\nSRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer\nis allocated at the target-chosen max_ti_iu_len, so the source of the\nsense copy lands past the bytes actually received; with resp_data_len\nnear 0xFFFFFFFF it is gigabytes past the buffer and the read faults.\n\nCopy the sense data only if it has not been truncated, that is, only if\nthe response header, the response data, and the sense region fit within\nthe bytes actually received; otherwise drop the sense and log. The\nin-tree iSER and NVMe-RDMA receive paths already bound their parse by\nwc->byte_len; this brings ib_srp into line with them."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - A malicious or compromised SRP target can trigger this by sending an SRP_RSP over the established RDMA network session to the initiator. The vulnerable parsing is reached from remote peer-controlled RDMA receive completions, not from local or physical access.\nAC:L - The target controls SRP_RSP flags and length fields and sees the command tag in each SRP_CMD, so it can craft a matching response with SRP_RSP_FLAG_SNSVALID and an oversized resp_data_len. No race or hard-to-control environmental condition is required.\nPR:N - The attacker needs control of the remote SRP target or a compromised target on the fabric, but no privileges on the vulnerable initiator host. The vulnerable receive path processes target responses after the initiator is connected.\nUI:N - Once the initiator is logged into the target, the target can trigger the bug by responding to normal SCSI commands or scan traffic. No additional victim user action is needed for the malicious SRP_RSP to be processed.\nS:U - The impact is within the vulnerable kernel instance processing the SRP response. This is not a guest-to-host escape, IOMMU bypass, or other cross-authority boundary change.\nC:H - The target-controlled offset can make the kernel read out of bounds from memory beyond the SRP receive buffer, with up to SCSI_SENSE_BUFFERSIZE bytes copied into sense data. Under the required higher-severity rule, this out-of-bounds kernel read is treated as high confidentiality impact.\nI:N - The bug is an out-of-bounds read source for a copy into the intended SCSI sense buffer, not an out-of-bounds write or control-flow overwrite. The target can already provide arbitrary valid sense data, so this flaw does not add a distinct kernel integrity primitive.\nA:H - With a large resp_data_len, the copy source can land far beyond the receive buffer and fault in kernel context, causing an oops or panic. The malicious target can repeat this by sending crafted responses."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/ulp/srp/ib_srp.c"], "versions": [{"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "3889517c2ec7f364914aea8209abfff735f7ecde", "status": "affected", "versionType": "git"}, {"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "ed77cc819ad631264787cade5ae5ec4c535ec6bb", "status": "affected", "versionType": "git"}, {"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "0b9ee09d5e849591f17d98c078033dadea967293", "status": "affected", "versionType": "git"}, {"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "0d64bc200ebe4f275b27438c6e593903e0b16fe1", "status": "affected", "versionType": "git"}, {"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "2015038195939eac54a1ee83c9d98ef1a8ccbbce", "status": "affected", "versionType": "git"}, {"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "f92a285db7ff6e598591ccbfb551be155c5f4d57", "status": "affected", "versionType": "git"}, {"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "3523e53ff95f1837ec3f57ff7558532bcb2661b7", "status": "affected", "versionType": "git"}, {"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "13e91fd076306f5d0cdfa14f53d69e37274723c4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/ulp/srp/ib_srp.c"], "versions": [{"version": "2.6.15", "status": "affected"}, {"version": "0", "lessThan": "2.6.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde"}, {"url": "https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb"}, {"url": "https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293"}, {"url": "https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1"}, {"url": "https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce"}, {"url": "https://git.kernel.org/stable/c/f92a285db7ff6e598591ccbfb551be155c5f4d57"}, {"url": "https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7"}, {"url": "https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4"}], "title": "RDMA/srp: bound SRP_RSP sense copy by the received length", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53186", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:26:22.541675Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:57:27.012Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53186", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:26:22.541675Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:26:23.461Z"}}], "cna": {"title": "RDMA/srp: bound SRP_RSP sense copy by the received length", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - A malicious or compromised SRP target can trigger this by sending an SRP_RSP over the established RDMA network session to the initiator. The vulnerable parsing is reached from remote peer-controlled RDMA receive completions, not from local or physical access.\nAC:L - The target controls SRP_RSP flags and length fields and sees the command tag in each SRP_CMD, so it can craft a matching response with SRP_RSP_FLAG_SNSVALID and an oversized resp_data_len. No race or hard-to-control environmental condition is required.\nPR:N - The attacker needs control of the remote SRP target or a compromised target on the fabric, but no privileges on the vulnerable initiator host. The vulnerable receive path processes target responses after the initiator is connected.\nUI:N - Once the initiator is logged into the target, the target can trigger the bug by responding to normal SCSI commands or scan traffic. No additional victim user action is needed for the malicious SRP_RSP to be processed.\nS:U - The impact is within the vulnerable kernel instance processing the SRP response. This is not a guest-to-host escape, IOMMU bypass, or other cross-authority boundary change.\nC:H - The target-controlled offset can make the kernel read out of bounds from memory beyond the SRP receive buffer, with up to SCSI_SENSE_BUFFERSIZE bytes copied into sense data. Under the required higher-severity rule, this out-of-bounds kernel read is treated as high confidentiality impact.\nI:N - The bug is an out-of-bounds read source for a copy into the intended SCSI sense buffer, not an out-of-bounds write or control-flow overwrite. The target can already provide arbitrary valid sense data, so this flaw does not add a distinct kernel integrity primitive.\nA:H - With a large resp_data_len, the copy source can land far beyond the receive buffer and fault in kernel context, causing an oops or panic. The malicious target can repeat this by sending crafted responses."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "3889517c2ec7f364914aea8209abfff735f7ecde", "versionType": "git"}, {"status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "ed77cc819ad631264787cade5ae5ec4c535ec6bb", "versionType": "git"}, {"status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "0b9ee09d5e849591f17d98c078033dadea967293", "versionType": "git"}, {"status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "0d64bc200ebe4f275b27438c6e593903e0b16fe1", "versionType": "git"}, {"status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "2015038195939eac54a1ee83c9d98ef1a8ccbbce", "versionType": "git"}, {"status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "f92a285db7ff6e598591ccbfb551be155c5f4d57", "versionType": "git"}, {"status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "3523e53ff95f1837ec3f57ff7558532bcb2661b7", "versionType": "git"}, {"status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "lessThan": "13e91fd076306f5d0cdfa14f53d69e37274723c4", "versionType": "git"}], "programFiles": ["drivers/infiniband/ulp/srp/ib_srp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.15"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.94", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/ulp/srp/ib_srp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde"}, {"url": "https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb"}, {"url": "https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293"}, {"url": "https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1"}, {"url": "https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce"}, {"url": "https://git.kernel.org/stable/c/f92a285db7ff6e598591ccbfb551be155c5f4d57"}, {"url": "https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7"}, {"url": "https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: bound SRP_RSP sense copy by the received length\n\nsrp_process_rsp() copies sense data from rsp->data + resp_data_len,\nwhere resp_data_len is the full 32-bit value supplied by the SRP target\nand is never checked against the number of bytes actually received\n(wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so\nat most 96 bytes are copied, but the source offset is not bounded.\n\nA malicious or compromised SRP target on the InfiniBand/RoCE fabric that\nthe initiator has logged into can return an SRP_RSP with\nSRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer\nis allocated at the target-chosen max_ti_iu_len, so the source of the\nsense copy lands past the bytes actually received; with resp_data_len\nnear 0xFFFFFFFF it is gigabytes past the buffer and the read faults.\n\nCopy the sense data only if it has not been truncated, that is, only if\nthe response header, the response data, and the sense region fit within\nthe bytes actually received; otherwise drop the sense and log. The\nin-tree iSER and NVMe-RDMA receive paths already bound their parse by\nwc->byte_len; this brings ib_srp into line with them."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.94", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.36", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.13", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "2.6.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:33:53.227Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53186", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:57:27.012Z", "dateReserved": "2026-06-09T07:44:35.390Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-25T08:38:59.508Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/ulp/srp/ib_srp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3889517c2ec7f364914aea8209abfff735f7ecde", "status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "versionType": "git"}, {"lessThan": "ed77cc819ad631264787cade5ae5ec4c535ec6bb", "status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "versionType": "git"}, {"lessThan": "0b9ee09d5e849591f17d98c078033dadea967293", "status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "versionType": "git"}, {"lessThan": "0d64bc200ebe4f275b27438c6e593903e0b16fe1", "status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "versionType": "git"}, {"lessThan": "2015038195939eac54a1ee83c9d98ef1a8ccbbce", "status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "versionType": "git"}, {"lessThan": "f92a285db7ff6e598591ccbfb551be155c5f4d57", "status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "versionType": "git"}, {"lessThan": "3523e53ff95f1837ec3f57ff7558532bcb2661b7", "status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "versionType": "git"}, {"lessThan": "13e91fd076306f5d0cdfa14f53d69e37274723c4", "status": "affected", "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/ulp/srp/ib_srp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.15"}, {"lessThan": "2.6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.94", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.36", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "83AFCE02-A944-4709-817B-357BAB817063", "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9", "versionEndExcluding": "6.12.94", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3", "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*", "matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: bound SRP_RSP sense copy by the received length\n\nsrp_process_rsp() copies sense data from rsp->data + resp_data_len,\nwhere resp_data_len is the full 32-bit value supplied by the SRP target\nand is never checked against the number of bytes actually received\n(wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so\nat most 96 bytes are copied, but the source offset is not bounded.\n\nA malicious or compromised SRP target on the InfiniBand/RoCE fabric that\nthe initiator has logged into can return an SRP_RSP with\nSRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer\nis allocated at the target-chosen max_ti_iu_len, so the source of the\nsense copy lands past the bytes actually received; with resp_data_len\nnear 0xFFFFFFFF it is gigabytes past the buffer and the read faults.\n\nCopy the sense data only if it has not been truncated, that is, only if\nthe response header, the response data, and the sense region fit within\nthe bytes actually received; otherwise drop the sense and log. The\nin-tree iSER and NVMe-RDMA receive paths already bound their parse by\nwc->byte_len; this brings ib_srp into line with them."}], "id": "CVE-2026-53186", "lastModified": "2026-10-19T20:19:07.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53186", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:26:22.541675Z", "version": "2.0.3"}}]}, "published": "2026-06-25T09:16:36.020", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f92a285db7ff6e598591ccbfb551be155c5f4d57"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: RDMA/srp: bound SRP_RSP sense copy by the received length", "id": "2492806", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492806"}, "csaw": false, "cwe": "CWE-130", "details": ["A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) SCSI RDMA Protocol (SRP) component. A malicious or compromised SRP target on the InfiniBand/RoCE fabric can exploit this vulnerability by sending a specially crafted SRP response with an excessively large data length. This can lead to an out-of-bounds read when processing sense data, causing read faults and potentially a denial of service (DoS) on the system."], "name": "CVE-2026-53186", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53186\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53186\nhttps://lore.kernel.org/linux-cve-announce/2026062556-CVE-2026-53186-5b7e@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef9ec39c47f0cece886ddd6b53c440321e0b2a6,3889517c2ec7f364914aea8209abfff735f7ecde)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef9ec39c47f0cece886ddd6b53c440321e0b2a6,ed77cc819ad631264787cade5ae5ec4c535ec6bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef9ec39c47f0cece886ddd6b53c440321e0b2a6,0b9ee09d5e849591f17d98c078033dadea967293)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef9ec39c47f0cece886ddd6b53c440321e0b2a6,0d64bc200ebe4f275b27438c6e593903e0b16fe1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef9ec39c47f0cece886ddd6b53c440321e0b2a6,2015038195939eac54a1ee83c9d98ef1a8ccbbce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef9ec39c47f0cece886ddd6b53c440321e0b2a6,f92a285db7ff6e598591ccbfb551be155c5f4d57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef9ec39c47f0cece886ddd6b53c440321e0b2a6,3523e53ff95f1837ec3f57ff7558532bcb2661b7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef9ec39c47f0cece886ddd6b53c440321e0b2a6,13e91fd076306f5d0cdfa14f53d69e37274723c4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.94,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.36,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-25T11:45:03.802209+00:00", "updated": "2026-10-20T14:45:13.853542+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}