CVE-2026-53371 Details
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound node_desc sysfs read with %.64s node_desc[64] in struct ib_device is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/infiniband/core/sysfs.c:1307), since node_desc_store() performs a raw memcpy of up to IB_DEVICE_NODE_DESC_MAX bytes with no NUL termination: memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX)); If exactly 64 bytes are written via the node_desc sysfs file, the array contains no NUL byte. The ionic hca_type_show() handler uses unbounded "%s" and will read past the end of node_desc into adjacent fields of struct ib_device until it encounters a NUL. ionic supports IB_DEVICE_MODIFY_NODE_DESC, so this is triggerable by userspace. Match the core handler and bound the format specifier.
A vulnerability in the Linux kernel's RDMA/Ionic component allows for an unbounded read from the sysfs node description. The issue arises because the node description in the 'ib_device' structure is not guaranteed to be null-terminated. The core InfiniBand sysfs handler uses a format specifier that expects a null-terminated string, but the 'node_desc_store' function can write up to the maximum node description length without adding a null terminator. This flaw can be exploited by user space applications, as the Ionic hardware component supports modifying the node description.
The vulnerability has been addressed by modifying the Ionic sysfs handler to use a bounded format specifier that matches the core InfiniBand sysfs handler. Users should update to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/61df14f306f153bffa2f3c74a94ff5a85c99fa39 | kernel.org | Patch |
| https://git.kernel.org/stable/c/654a27f25530d052eeedf086e6c3e2d585c203bd | kernel.org | Patch |
| https://git.kernel.org/stable/c/a3e9372203afde2c62576356bb9a17890bc7fd6c | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.18, < 6.18.30 >= 6.19, < 7.0.7 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | Initial Analysis | [email protected] |
| Jul 19, 2026 | New CVE Received | kernel.org |