CVE-2026-53186 Overview
CVE-2026-53186 is an out-of-bounds read vulnerability in the Linux kernel's RDMA Storage Protocol (SRP) initiator driver. The flaw resides in srp_process_rsp(), which copies sense data from rsp->data + resp_data_len without validating resp_data_len against the actual number of bytes received (wc->byte_len). A malicious or compromised SRP target on an InfiniBand or RoCE fabric can return an SRP_RSP response with SRP_RSP_FLAG_SNSVALID set and a resp_data_len value approaching 0xFFFFFFFF. The source offset of the sense copy then lands gigabytes past the allocated receive buffer, triggering a kernel read fault.
Critical Impact
A hostile SRP target can crash the initiator kernel by inducing an out-of-bounds read in srp_process_rsp(), resulting in denial of service on storage clients connected over InfiniBand or RoCE.
Affected Products
- Linux kernel ib_srp driver (RDMA/srp module)
- Systems using InfiniBand or RoCE fabrics with SRP initiators
- Stable kernel branches patched via the commits referenced by kernel.org
Discovery Timeline
- 2026-06-25 - CVE CVE-2026-53186 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53186
Vulnerability Analysis
The srp_process_rsp() function in the Linux kernel ib_srp driver handles incoming SRP_RSP messages from SRP storage targets. When a response carries valid sense data, the function copies up to SCSI_SENSE_BUFFERSIZE (96 bytes) into the SCSI command's sense buffer. The copy length is bounded, but the source pointer is computed as rsp->data + resp_data_len, where resp_data_len is a 32-bit value supplied directly by the target.
The receive buffer is allocated at max_ti_iu_len, a size negotiated with the target during login. Because the source offset is never compared against wc->byte_len (the number of bytes the RDMA completion actually delivered), an attacker-controlled offset directs the read to memory well beyond the valid receive region. With resp_data_len near 0xFFFFFFFF, the read crosses gigabytes of address space and faults.
Root Cause
The root cause is missing input validation on a length field originating from an untrusted network peer. The driver trusts resp_data_len from the target without confirming that the response header, response data, and sense region all fit within wc->byte_len. Comparable in-tree RDMA receive paths, including iSER and NVMe-RDMA, already bound their parsing by wc->byte_len. The ib_srp driver did not, leaving an out-of-bounds read primitive reachable by any reachable SRP target.
Attack Vector
Exploitation requires an attacker to control or compromise an SRP target that the initiator has logged into over an InfiniBand or RoCE fabric. After login, the target sends a crafted SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The initiator kernel then attempts a memcpy whose source address is far outside the receive buffer, faulting and producing a kernel oops or panic. The impact is denial of service on the storage client. The fix copies sense data only when the response header, response data, and sense region all fit within the bytes actually received; otherwise the sense is dropped and an error is logged.
Detection Methods for CVE-2026-53186
Indicators of Compromise
- Kernel oops or page-fault messages referencing srp_process_rsp or ib_srp in dmesg or /var/log/kern.log
- Unexpected SRP session resets or initiator crashes immediately following responses from a specific target
- SRP targets returning responses with abnormally large resp_data_len values relative to negotiated max_ti_iu_len
Detection Strategies
- Audit kernel build versions across hosts running ib_srp and flag any that predate the patched commits referenced on git.kernel.org
- Capture RDMA fabric traffic where feasible and inspect SRP_RSP frames for resp_data_len values exceeding wc->byte_len
- Correlate storage initiator reboots or kernel panics with SRP target connectivity events in centralized logs
Monitoring Recommendations
- Forward kernel logs from SRP initiator hosts to a centralized log platform and alert on BUG:, Oops:, or general protection fault entries that include srp_ symbols
- Inventory all systems with the ib_srp module loaded using lsmod | grep ib_srp and track patch status
- Monitor SRP target endpoints for unexpected configuration changes or unknown peers joining the fabric
How to Mitigate CVE-2026-53186
Immediate Actions Required
- Apply the upstream Linux kernel patches that bound the SRP sense copy by wc->byte_len, as committed in the stable branches
- Restrict the set of SRP targets the initiator is allowed to log into and verify that all targets are trusted and patched
- On hosts that do not require SRP, unload the ib_srp module with modprobe -r ib_srp and blacklist it
Patch Information
The vulnerability is resolved by a series of stable-tree commits that drop sense data unless the response header, response data, and sense region all fit within wc->byte_len. The fixes are available in the following commits: 0b9ee09, 0d64bc2, 13e91fd, 2015038, 3523e53, 3889517, ed77cc8, and f92a285d. Rebuild and deploy kernels from a distribution that has merged these fixes.
Workarounds
- Segment InfiniBand and RoCE fabrics so that initiators only communicate with vetted, patched SRP targets
- Disable SRP and migrate to alternative storage transports such as iSER or NVMe-RDMA where the receive parse is already bounded by wc->byte_len
- Where feasible, blacklist the ib_srp kernel module on hosts that do not require SRP connectivity
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
