Skip to main content

Linux Kernel EUVDEUVD-2026-39278

| CVE-2026-53187 HIGH
Out-of-bounds Write (CWE-787)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-rc47-m48r-2657
Buffer Overflow Linux Memory Corruption Red Hat Suse
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Requires local access to RDMA uverbs with existing low privileges (AV:L/PR:L); OOB read leaks kernel memory (C:H) and panic_on_warn forces reboot (A:H) with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:26 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.1 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

The cpu_id attribute supplied by user space through UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu() without first verifying that the value is within the valid CPU range.

Passing such untrusted data to cpumask_test_cpu() may lead to an out-of-bounds read of the underlying cpumask bitmap: the helper expands to a test_bit() that indexes the bitmap by cpu_id / BITS_PER_LONG with no bound check.

In addition, on kernels built with CONFIG_DEBUG_PER_CPU_MAPS it trips the WARN_ON_ONCE() in cpumask_check(); combined with panic_on_warn this turns a bad user input into a machine reboot.

Reject any cpu_id that is not smaller than nr_cpu_ids with -EINVAL before it is used.

Reported by Smatch.

AnalysisAI

Local out-of-bounds read in the Linux kernel's RDMA/core subsystem allows a low-privileged user with access to RDMA uverbs to crash the system or leak adjacent kernel memory by supplying an unvalidated cpu_id during DMA handle (DMAH) allocation. The UVERBS_ATTR_ALLOC_DMAH_CPU_ID attribute is passed straight to cpumask_test_cpu() without a bounds check, and on CONFIG_DEBUG_PER_CPU_MAPS kernels combined with panic_on_warn it forces a reboot. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).

Technical ContextAI

The flaw lives in the InfiniBand/RDMA core (drivers/infiniband/core) uverbs interface, which exposes RDMA verbs to user space. When user space allocates a DMA handle (DMAH), it can pass a cpu_id via UVERBS_ATTR_ALLOC_DMAH_CPU_ID. The kernel feeds this untrusted integer directly into cpumask_test_cpu(), a helper that expands to test_bit() indexing the cpumask bitmap at cpu_id / BITS_PER_LONG with no range validation against nr_cpu_ids. The root cause is a missing input validation / out-of-bounds array read (conceptually CWE-125 Out-of-bounds Read and CWE-20 Improper Input Validation; NVD lists CWE as N/A). The issue was surfaced by the Smatch static analyzer, and the fix rejects any cpu_id >= nr_cpu_ids with -EINVAL before use.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel build - 6.18.36, 7.0.13, or 7.1 (or your distribution's backported equivalent containing the stable fix commits). Apply the upstream commits at https://git.kernel.org/stable/c/0efbb6b54ff56300867027d8e0800d0e32226a20, https://git.kernel.org/stable/c/323c98a4ff06aa28114f2bf658fb43eb3b536bbc, and https://git.kernel.org/stable/c/bd5e818be7964c1689fba2dad9e6bd3a827fee74, which add the nr_cpu_ids bounds check that returns -EINVAL on invalid cpu_id. If immediate patching is not possible, restrict access to RDMA verbs by limiting which users and containers can open /dev/infiniband/uverbs* devices (tighten device permissions or use a restrictive cgroup/device policy), or unload/disable RDMA (ib_uverbs) modules entirely on hosts that do not require InfiniBand/RoCE - with the trade-off that this disables RDMA functionality for any workload depending on it. To reduce the forced-reboot impact specifically, avoid running with panic_on_warn enabled on exposed multi-tenant hosts, accepting that you lose the fail-fast crash behavior some hardened deployments rely on.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-39278 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy