What is the CVSS score of CVE-2026-53371?

CVE-2026-53371 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-53371?

Yes, a patch is available for CVE-2026-53371. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-53371

EUVD-2026-45441 MEDIUM

2026-07-19 Linux

GHSA-wcp7-j68j-j6mv

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.1 MEDIUM

Local vector confirmed; C:L added over official C:N because adjacent struct fields are read, potentially exposing kernel pointers.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 19:26 vuln.today

CVSS changed

Jul 29, 2026 - 17:07 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 11:02 EUVD

CVE Published

Jul 19, 2026 - 09:10 nvd

MEDIUM 5.5

CVE Published

Jul 19, 2026 - 09:10 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ionic: bound node_desc sysfs read with %.64s

node_desc[64] in struct ib_device is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/infiniband/core/sysfs.c:1307), since node_desc_store() performs a raw memcpy of up to IB_DEVICE_NODE_DESC_MAX bytes with no NUL termination:

memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX));

If exactly 64 bytes are written via the node_desc sysfs file, the array contains no NUL byte. The ionic hca_type_show() handler uses unbounded "%s" and will read past the end of node_desc into adjacent fields of struct ib_device until it encounters a NUL.

ionic supports IB_DEVICE_MODIFY_NODE_DESC, so this is triggerable by userspace.

Match the core handler and bound the format specifier.

AnalysisAI

Out-of-bounds read in the Linux kernel RDMA/ionic driver's hca_type_show() sysfs handler allows a local user to trigger a kernel crash or leak adjacent kernel memory. The ionic driver's use of an unbounded "%s" format specifier on the 64-byte node_desc field - which is not guaranteed to be NUL-terminated - causes the kernel to read past the end of that field into adjacent members of struct ib_device when exactly 64 bytes have been written. Since ionic supports IB_DEVICE_MODIFY_NODE_DESC, this condition is reachable from unprivileged userspace. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), indicating low exploitation probability in the wild.

Technical ContextAI

The vulnerability resides in the RDMA/ionic driver within the Linux kernel (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). The InfiniBand core stores a device descriptor in node_desc[64] (struct ib_device), which is populated via node_desc_store() using a raw memcpy of up to IB_DEVICE_NODE_DESC_MAX (64) bytes with no NUL termination appended. The core IB sysfs handler defensively uses "%.64s" to bound reads. However, the ionic driver's hca_type_show() function uses an unbounded "%s", so when node_desc contains no NUL byte (i.e., exactly 64 bytes were written), the format string scans past the end of the array into adjacent struct ib_device fields until a NUL byte is found in kernel memory. The root cause is a classic out-of-bounds read (conceptually aligned with CWE-126/CWE-125, though NVD lists CWE as N/A) triggered through the sysfs virtual filesystem interface.

RemediationAI

The vendor-released patch is available in Linux 7.1, 6.18.30, and 7.0.7. The fix changes hca_type_show() to use "%.64s" instead of "%s", matching the approach already used by the core IB sysfs handler, and is tracked at upstream kernel commits https://git.kernel.org/stable/c/654a27f25530d052eeedf086e6c3e2d585c203bd, https://git.kernel.org/stable/c/61df14f306f153bffa2f3c74a94ff5a85c99fa39, and https://git.kernel.org/stable/c/a3e9372203afde2c62576356bb9a17890bc7fd6c. Ubuntu users should apply USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). Where patching is not immediately possible, a compensating control is to restrict local user write access to the node_desc sysfs file (e.g., via udev rules or filesystem permissions), which prevents creation of the non-NUL-terminated condition; this trade-off is that legitimate InfiniBand fabric management relying on node_desc writes will be blocked. Alternatively, blacklisting the ib_core or ionic_rdma module on systems not requiring RDMA will eliminate the attack surface entirely but will disable RDMA functionality.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-53371 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-53371

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code