Skip to main content

Linux Kernel EUVDEUVD-2026-39279

| CVE-2026-53188 HIGH
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-4rj2-pr7f-cmpg
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local access (AV:L) by a low-privileged user (PR:L); AC:H because the attacker must arrange a block device aliasing the ucap dev_t; scope change and high impact reflect crossing the RDMA capability boundary.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:27 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Validate the passed in fops for ib_get_ucaps()

Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same dev_t it can masquerade as a ucap cdev fd.

Test the f_ops to only accept authentic cdevs.

AnalysisAI

Privilege/capability boundary bypass in the Linux kernel RDMA/core subsystem (ib_get_ucaps) lets a local low-privileged user masquerade as an authentic user-capability (ucap) character-device file descriptor. Because char and block devices share the dev_t namespace, the kernel previously validated only the device number, so a block device with a matching dev_t could be passed to ib_get_ucaps() to impersonate a legitimate ucap cdev and obtain RDMA capabilities the user should not hold. The fix validates the file's f_ops to accept only genuine cdevs. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; a stable-tree vendor patch is available.

Technical ContextAI

The affected component is the RDMA (Remote Direct Memory Access) core in the InfiniBand/RDMA stack, specifically the ib_get_ucaps() path used to resolve user capabilities (ucaps) from a file descriptor referencing a ucap character device. In Linux, character and block devices share the same dev_t (major/minor) numbering space, so identifying a device solely by dev_t is ambiguous - a block device can carry the same dev_t as a ucap cdev. The root cause is a type-confusion / insufficient-validation class issue (CWE-843 type confusion, closely related to CWE-20 improper input validation; NVD lists CWE as N/A): the code trusted the dev_t alias instead of confirming the underlying object type. The corrective patch checks the file_operations (f_ops) pointer to confirm the fd is a bona fide ucap cdev before granting the associated RDMA capabilities.

RemediationAI

Patch available per vendor advisory: update to a kernel build that includes the fix from the upstream stable commits 4a1b1ac2744694a2ecd66a84bdb1445f4ef24bee, 96b6e98ff12d50ed5817230c6f1188e1150d225d, or aa181287ebdcc53ee0ba5c2f8243e2d541ebc19b (https://git.kernel.org/stable/c/4a1b1ac2744694a2ecd66a84bdb1445f4ef24bee), corresponding to fixed stable releases (EUVD references the 6.18.36 series and 7.x branches - confirm the exact patched version against your distribution's changelog rather than relying on the malformed EUVD tokens). If you cannot patch immediately, reduce exposure by restricting which local users can reach the RDMA ucaps interface: avoid granting untrusted local accounts access to RDMA device nodes, and on hosts that do not require RDMA user capabilities consider disabling or not loading the RDMA ucaps functionality (trade-off: this breaks legitimate RDMA capability delegation for applications that depend on it). Tighten permissions on /dev device nodes so unprivileged users cannot open block devices crafted to alias a ucap dev_t. Apply the distribution-provided kernel update as the durable fix; the workarounds only narrow the local attack surface.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-39279 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy