CVE-2026-53176 Overview
CVE-2026-53176 is an integer underflow vulnerability in the Linux kernel's iSER (iSCSI Extensions for RDMA) target driver located in drivers/infiniband/ulp/isert/ib_isert.c. The flaw resides in the isert_login_recv_done() function, which computes the login request payload length without enforcing a lower bound. A remote iSER initiator can send a login Protocol Data Unit (PDU) shorter than ISER_HEADERS_LEN (76 bytes), causing a signed integer underflow that propagates into a memcpy() length argument. The resulting out-of-bounds copy crashes the target node. Because the login phase precedes iSCSI authentication, no credentials are required to trigger the condition.
Critical Impact
Unauthenticated remote attackers with network access to an iSER target can crash the kernel by sending a malformed login PDU, resulting in denial of service of storage target nodes.
Affected Products
- Linux kernel versions containing the ib_isert driver prior to the fix
- Systems running iSER target services using InfiniBand or RDMA transports
- Storage appliances and servers exposing iSER login endpoints to untrusted networks
Discovery Timeline
- 2026-06-25 - CVE-2026-53176 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53176
Vulnerability Analysis
The vulnerability is an integer underflow [CWE-191] in the iSER target login receive path. In isert_login_recv_done(), the driver calculates the login request payload size as wc->byte_len - ISER_HEADERS_LEN and stores the result in login_req_len, a signed int. The code never validates that wc->byte_len is greater than or equal to ISER_HEADERS_LEN (76 bytes) before performing the subtraction.
When a remote initiator posts a Send work request carrying fewer than 76 bytes, the subtraction wraps to a large negative value. The function isert_rx_login_req() then reads login_req_len and applies size = min(rx_buflen, MAX_KEY_VALUE_PAIRS). Because min() operates on signed integers, the negative value is preserved instead of being clamped.
The negative size is passed as the length argument to memcpy(), where it is sign-extended into a multi-gigabyte size_t. The copy overruns the 8192-byte login->req_buf destination, faults, and crashes the kernel.
Root Cause
The root cause is a missing lower-bound check on attacker-controlled length data combined with signed-to-unsigned conversion. The upper bound was already safe because the posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, keeping the difference within MAX_KEY_VALUE_PAIRS. Only the missing lower bound creates the exploitable condition.
Attack Vector
A remote attacker with network reachability to the iSER target posts a login Send work request with a payload smaller than ISER_HEADERS_LEN. The malformed PDU traverses the RDMA transport, reaches isert_login_recv_done(), and triggers the underflow. No iSCSI authentication occurs before this code path executes, so the attacker requires no credentials. The verified upstream patch rejects any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion. See the Linux Kernel Commit for the fix.
Detection Methods for CVE-2026-53176
Indicators of Compromise
- Unexpected kernel panics or oops messages referencing isert_rx_login_req or isert_login_recv_done in dmesg or /var/log/messages.
- Sudden disconnection of iSER initiators from a target node followed by node reboot or hang.
- Page fault traces involving memcpy called from the iSER login receive path.
Detection Strategies
- Audit kernel versions on storage and RDMA-enabled hosts to identify systems running unpatched ib_isert code.
- Monitor RDMA Connection Manager (CM) traffic for login PDUs whose advertised lengths fall below the 76-byte ISER_HEADERS_LEN threshold.
- Correlate iSER target service restarts with preceding RDMA login attempts from unfamiliar source addresses.
Monitoring Recommendations
- Enable kernel crash dump collection (kdump) on iSER target nodes to capture stack traces if the vulnerability is triggered.
- Forward kernel logs to a centralized logging or SIEM platform and alert on signatures matching iSER fault traces.
- Track availability metrics on iSER target services to detect repeated crash-and-restart cycles indicative of probing.
How to Mitigate CVE-2026-53176
Immediate Actions Required
- Apply the upstream Linux kernel patch that rejects login PDUs shorter than ISER_HEADERS_LEN before the subtraction in isert_login_recv_done().
- Restrict network access to iSER target ports so that only trusted storage initiators on isolated storage fabrics can reach the login path.
- Inventory all hosts running the ib_isert kernel module and prioritize patching for internet-exposed or shared-network systems.
Patch Information
The fix has been merged across multiple stable Linux kernel branches. Reference commits include 1ca40b243277, 29e7b925ae6d, 75ee6e4aa096, bd22740d7f14, c1234229399f, c5584e089b5a, df422fd273c9, and e8a013c0c3ca. Administrators should update to the latest stable point release on their supported kernel branch.
Workarounds
- Unload the ib_isert kernel module on systems that do not require iSER target functionality using modprobe -r ib_isert.
- Block inbound RDMA login traffic at the network layer by segmenting storage fabrics from general-purpose networks.
- Disable iSER target portals in the LIO/targetcli configuration until kernels can be patched, falling back to TCP-based iSCSI where feasible.
# Configuration example: unload vulnerable module and verify
sudo modprobe -r ib_isert
lsmod | grep ib_isert
# Confirm running kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
