CVE-2026-53371: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53371 Overview

CVE-2026-53371 is an out-of-bounds read vulnerability in the Linux kernel's RDMA/ionic driver. The flaw resides in the hca_type_show() sysfs handler, which uses an unbounded %s format specifier when printing the node_desc field of struct ib_device. Because node_desc[64] is not guaranteed to be NUL-terminated, the handler can read past the buffer into adjacent fields until it encounters a NUL byte. Userspace can trigger the condition by writing exactly 64 bytes through the node_desc sysfs interface, since the ionic driver supports IB_DEVICE_MODIFY_NODE_DESC.

Critical Impact
Local userspace can trigger a kernel out-of-bounds read that exposes contents of adjacent ib_device memory through the sysfs interface.

Affected Products

Linux kernel with the RDMA/ionic driver enabled
Systems using AMD Pensando ionic RDMA hardware
Distributions shipping the affected drivers/infiniband/hw/ionic code prior to the fix

Discovery Timeline

2026-07-19 - CVE-2026-53371 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-53371

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the ionic RDMA driver's sysfs display routine. The Linux InfiniBand core stores a device description in node_desc[64] inside struct ib_device. This field is a fixed-size buffer that is intentionally not NUL-terminated, because node_desc_store() performs a raw memcpy of up to IB_DEVICE_NODE_DESC_MAX (64) bytes from user-supplied data without appending a terminator.

The core IB sysfs handler in drivers/infiniband/core/sysfs.c correctly accounts for this by using the bounded %.64s format specifier. The ionic driver's hca_type_show() handler diverged from this convention and used an unbounded %s. When exactly 64 bytes are written to the node_desc sysfs file, no NUL exists inside the buffer, and sprintf continues reading adjacent fields of the ib_device structure until one is found.

Root Cause

The root cause is inconsistent handling of a non-NUL-terminated fixed-size buffer. The ionic driver assumed node_desc was a C string, but the InfiniBand core treats it as a bounded byte array. Using %s on a buffer without a guaranteed terminator produces an unbounded read that leaks memory contents past the intended structure member.

Attack Vector

A local user with permission to write to the node_desc sysfs attribute can populate the buffer with exactly 64 non-zero bytes through the IB core's IB_DEVICE_MODIFY_NODE_DESC path, which ionic exposes. A subsequent read of the ionic hca_type sysfs attribute will then disclose adjacent kernel memory contents from within struct ib_device. The disclosed data can aid further attacks by revealing pointers, identifiers, or other kernel structure fields.

See the upstream fix commits for the exact patched format string:

Detection Methods for CVE-2026-53371

Indicators of Compromise

Writes of exactly 64 bytes to /sys/class/infiniband/<dev>/node_desc on hosts with ionic RDMA devices
Unexpected reads of /sys/class/infiniband/<dev>/hca_type following modification of node_desc
Kernel warnings or KASAN reports indicating out-of-bounds reads inside hca_type_show()

Detection Strategies

Enable KASAN on test kernels to catch the out-of-bounds read at runtime
Audit installed kernel versions against the fixed commits listed in the upstream references
Monitor auditd for open and write syscalls targeting node_desc and hca_type sysfs files under /sys/class/infiniband/

Monitoring Recommendations

Log local process access to InfiniBand sysfs attributes and alert on writes originating from non-administrative accounts
Track kernel build versions across the fleet and flag hosts still running pre-patch ionic drivers
Correlate sysfs write events with subsequent reads of adjacent attributes to identify probing behavior

How to Mitigate CVE-2026-53371

Immediate Actions Required

Apply the upstream Linux kernel patch that changes hca_type_show() to use the bounded %.64s format specifier
Update to a distribution kernel that includes commits 61df14f, 654a27f, or a3e9372
Restrict write permissions on InfiniBand sysfs attributes to trusted administrative accounts

Patch Information

The fix aligns the ionic driver with the InfiniBand core by bounding the format specifier to 64 characters. Refer to the Kernel Git Commit 61df14f, Kernel Git Commit 654a27f, and Kernel Git Commit a3e9372 for the exact source change. Rebuild affected kernels or install vendor-provided updated packages.

Workarounds

Unload the ionic_rdma module on systems that do not require RDMA functionality
Tighten Unix permissions on /sys/class/infiniband/<dev>/node_desc to prevent unprivileged writes
Use mandatory access control policies such as SELinux or AppArmor to deny non-root processes access to InfiniBand sysfs attributes

bash

# Restrict write access to node_desc until the patched kernel is deployed
chmod 0600 /sys/class/infiniband/*/node_desc
# Optionally unload the driver on hosts that do not use ionic RDMA
modprobe -r ionic_rdma