CVE-2026-53133: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53133 Overview

CVE-2026-53133 is a numeric truncation vulnerability in the Linux kernel's Remote Direct Memory Access (RDMA) user memory (umem) subsystem. The flaw resides in the __rdma_block_iter_next() function, which reassembles scatter-gather (SG) entries when the IOMMU linearizes a mapping into a single block split across multiple SG entries. The function overflows 32-bit stack values when computing Direct Memory Access (DMA) addresses for blocks that are 4 GB or larger. As a result, DMA addresses for subsequent blocks after the truncation point are computed incorrectly. The Linux kernel maintainers have resolved the issue by using the correct integer types to hold DMA addresses.

Critical Impact
Incorrect DMA address computation for large RDMA mappings can lead to memory corruption, data integrity loss, or denial of service on systems using RDMA hardware with IOMMU enabled.

Affected Products

Linux kernel (RDMA/umem subsystem)
Systems using RDMA hardware with IOMMU-backed linearized mappings
Distributions shipping kernels prior to the fixes referenced in the upstream commits

Discovery Timeline

2026-06-25 - CVE-2026-53133 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53133

Vulnerability Analysis

The vulnerability lies in the RDMA user memory management code, specifically in how __rdma_block_iter_next() handles block iteration over scatter-gather lists. When the IOMMU linearizes RDMA memory mappings, it can produce a single contiguous block that is represented as multiple SG entries. The iterator must reassemble these entries to compute DMA addresses for each fixed-size block. The defect occurs because intermediate calculations use 32-bit integers to track offsets and sizes. When a block size meets or exceeds 4 GB, the 32-bit values overflow and wrap around, producing truncated arithmetic results.

Root Cause

The root cause is a numeric truncation error in which DMA address arithmetic uses 32-bit signed or unsigned integer types instead of types large enough to represent full 64-bit DMA addresses. On systems with sufficient physical memory and IOMMU-merged mappings, the cumulative offset can exceed 0xFFFFFFFF, causing silent truncation. The upstream fix changes the variable types used in __rdma_block_iter_next() to properly sized DMA address types.

Attack Vector

The vulnerability requires a workload that registers RDMA memory regions large enough to produce IOMMU-linearized blocks of 4 GB or more. Triggering the bug results in incorrect DMA addresses being programmed into RDMA hardware, which can cause data to be read from or written to unintended physical memory locations. This can manifest as data corruption, kernel instability, or potential exposure of memory contents to a remote RDMA peer. Exploitation requires local privileges sufficient to allocate and register large RDMA memory regions.

No public proof-of-concept code or verified exploit is available for this issue. Refer to the upstream Linux kernel commits for the precise code-level fix and affected paths.

Detection Methods for CVE-2026-53133

Indicators of Compromise

Unexpected kernel warnings, oops messages, or panics originating from the ib_core or rdma_core modules under heavy RDMA workloads.
Data integrity errors in RDMA-backed applications such as NVMe-oF, NFS over RDMA, or HPC frameworks using GPUDirect.
Anomalous DMA fault entries reported by the IOMMU when handling large memory registrations.

Detection Strategies

Inventory running kernel versions and identify hosts using RDMA (InfiniBand, RoCE, iWARP) drivers with IOMMU enabled.
Correlate dmesg logs for RDMA subsystem errors with workloads that register memory regions larger than 4 GB.
Monitor for IOMMU translation faults on RDMA-enabled hosts, which can indicate truncated DMA addresses being issued.

Monitoring Recommendations

Centralize kernel logs from RDMA-capable hosts and alert on ib_, mlx, irdma, or bnxt_re driver errors.
Track package versions of Linux kernels across the fleet and flag hosts running pre-patch versions.
Audit RDMA memory registration sizes via subsystem counters to identify workloads at risk of triggering the defect.

How to Mitigate CVE-2026-53133

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the official commits as soon as distribution updates are available.
Prioritize patching on hosts running RDMA workloads with large memory regions, including storage targets and HPC compute nodes.
Validate that vendor kernels from Red Hat, SUSE, Ubuntu, and Oracle have incorporated the upstream fix before deployment.

Patch Information

The fix is committed upstream in the stable Linux kernel tree. See the patches at Linux Kernel Commit 15fe76e2, Commit 2ff4b781, Commit 8fe0231a, Commit ac1aad8e, Commit afd35fec, Commit baf8685b, Commit cc644d56, and Commit dee2a49a. The fix updates __rdma_block_iter_next() to use DMA-address-sized integer types.

Workarounds

Limit the size of individual RDMA memory regions registered by applications to values well below 4 GB where feasible.
Disable IOMMU linearization of RDMA mappings on affected hosts if the workload allows, accepting the performance trade-off.
Restrict access to RDMA verbs and memory registration interfaces to trusted local users until patching is complete.

bash

# Verify running kernel version and RDMA module status
uname -r
lsmod | grep -E 'ib_core|rdma_cm|mlx|irdma|bnxt_re'

# Check IOMMU status
dmesg | grep -i -E 'iommu|dmar'

# Inspect RDMA devices on the host
ibv_devices
ibv_devinfo