Skip to main content

Linux Kernel CVE-2026-53133

| EUVDEUVD-2026-39338 HIGH
Incorrect Conversion between Numeric Types (CWE-681)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-5rwx-cqg3-893x
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local RDMA-device access gives PR:L; the IOMMU-enabled, >=4G-block prerequisites make it AC:H; DMA-address corruption supports C/I/A:H within an unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:14 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umem: Fix truncation for block sizes >= 4G

When the iommu is used the linearization of the mapping can give a single block that is very large split across multiple SG entries.

When __rdma_block_iter_next() reassembles the split SG entries it is overflowing the 32 bit stack values and computed the wrong DMA addresses for blocks after the truncation.

Use the right types to hold DMA addresses.

AnalysisAI

Memory corruption in the Linux kernel's RDMA/umem subsystem occurs because __rdma_block_iter_next() uses 32-bit types to reassemble scatter-gather entries, truncating DMA addresses for block sizes of 4GB or larger when an IOMMU linearizes the mapping. Affected versions span the long-lived 5.2 through 7.1 development line; a low-privileged local actor with RDMA device access can drive the kernel to compute wrong DMA addresses, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with the narrow hardware/configuration prerequisites.

Technical ContextAI

The flaw lives in the RDMA (Remote Direct Memory Access) user-memory registration path used by InfiniBand and RoCE stacks. When an IOMMU is present, DMA mapping linearization can produce a single very large physical block represented across multiple scatter-gather (SG) list entries. The block iterator __rdma_block_iter_next() walks and reassembles these split SG entries to compute per-block DMA addresses, but it stored intermediate/accumulated address values in 32-bit variables. For any block at or beyond the 4GB (2^32) boundary the value wraps/truncates, so every block after the truncation point is assigned an incorrect DMA address. The root-cause class is an integer truncation / overflow (CWE-190/CWE-197 family; CWE was listed as N/A in the feed), and the fix is simply widening the variables to the correct DMA-address types (dma_addr_t). The vendor-affirmed Tags 'Buffer Overflow, Linux' point at the same memory-safety category.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel for your series - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 or later - using your distribution's backport once available. The fix is the upstream commit set on https://git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/baf8685bcf56dc1efb44b8f6a57c42516e549068 and the sibling stable commits) that widens the DMA-address variables to dma_addr_t. If you cannot patch immediately, reduce exposure by restricting access to RDMA devices (tighten permissions on /dev/infiniband/* and limit which users/containers can issue RDMA verbs), since the bug requires local access to register oversized memory regions; where RDMA is not needed, unload the relevant RDMA/InfiniBand drivers or avoid enabling the IOMMU-linearized large-block path - the trade-off is loss of RDMA functionality or IOMMU isolation, so this only suits hosts that do not depend on RDMA fabrics. Avoid workloads that register memory regions at or above 4GB on affected, IOMMU-enabled hosts until patched.

Same weakness CWE-681 – Incorrect Conversion between Numeric Types

View all
CVE-2017-7308 HIGH POC
7.8
CVE-2016-3074 CRITICAL POC
9.8
CVE-2021-38187 CRITICAL POC
9.8
CVE-2022-34169 HIGH POC
7.5
CVE-2022-27882 HIGH POC
7.5
CVE-2021-27219 HIGH POC
7.5
CVE-2020-6582 HIGH POC
7.5
CVE-2019-16200 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

Share

CVE-2026-53133 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy