CVE-2026-63860: Linux Kernel RDMA Core Vulnerability

CVE-2026-63860 Overview

CVE-2026-63860 is a Linux kernel vulnerability in the RDMA (Remote Direct Memory Access) core subsystem. The flaw stems from the use of NLA_STRING for netlink attributes that are subsequently evaluated as C-strings via strcmp. Because NLA_STRING does not verify the presence of a \0 terminator, the kernel may read past the intended buffer boundary when comparing attribute values. The maintainers resolved the issue by switching the affected attributes to NLA_NUL_STRING, which enforces null termination at the netlink parsing layer.

Critical Impact
A local attacker with the ability to send crafted netlink messages to the RDMA subsystem can trigger out-of-bounds reads that impact kernel confidentiality, integrity, and availability.

Affected Products

Linux kernel RDMA/core subsystem (upstream)
Linux stable kernel branches referenced in the fix commits
Distributions shipping kernels prior to the merged patches

Discovery Timeline

2026-07-19 - CVE-2026-63860 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63860

Vulnerability Analysis

The vulnerability resides in the RDMA/core netlink attribute handling code. The affected attributes were declared with the NLA_STRING policy type but processed later using strcmp(), which requires a null-terminated C-string. When userspace supplies a netlink attribute without a trailing \0, strcmp() reads adjacent memory until it encounters a null byte. Similarly, using the plain %s printf format specifier on such attributes results in reading beyond the intended payload length. The behavior sits at the intersection of an [Out-of-Bounds Read] and [Improper Input Validation] weakness class.

Root Cause

The root cause is a mismatch between the netlink attribute policy declaration and the runtime consumers of that data. NLA_STRING validates only the maximum length of the attribute; it does not guarantee the presence of a terminating null byte. The RDMA/core code then treats the buffer as a standard C-string. The maintainer commit message notes that switching to NLA_NUL_STRING is the simpler solution because existing userspace already sends the terminating nul, though it was never enforced.

Attack Vector

Exploitation requires local access with the ability to open a netlink socket to the RDMA subsystem. An attacker crafts an NLA_STRING attribute without a trailing null byte and sends it through the RDMA netlink interface. When the kernel invokes strcmp() on the attribute payload, it dereferences bytes outside the attribute buffer. Depending on adjacent kernel memory layout, this can leak sensitive kernel data, corrupt comparison logic, or cause a fault leading to denial of service.

No verified public exploit code is available. Refer to the Kernel Git Commit for the authoritative patch details.

Detection Methods for CVE-2026-63860

Indicators of Compromise

Unexpected RDMA_NL netlink traffic from non-privileged user sessions or containers.
Kernel oops or KASAN reports referencing strcmp within RDMA/core call paths.
Anomalous process access to /dev/infiniband/ devices from unusual UIDs.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test environments to surface out-of-bounds reads triggered by malformed netlink attributes.
Audit auditd for netlink socket creation targeting NETLINK_RDMA from unprivileged contexts.
Correlate kernel ring buffer messages with process telemetry to identify local processes generating malformed RDMA netlink messages.

Monitoring Recommendations

Alert on kernel warnings or panics originating from drivers/infiniband/core/ symbols.
Track workloads that load the ib_core or rdma_cm modules on systems that do not require RDMA functionality.
Baseline expected RDMA netlink activity per host and flag deviations, particularly from container or sandboxed workloads.

How to Mitigate CVE-2026-63860

Immediate Actions Required

Apply the upstream stable kernel updates that include the RDMA/core NLA_NUL_STRING fix on all affected hosts.
Prioritize patching on multi-tenant hosts, container platforms, and systems that expose RDMA to untrusted local users.
Restrict access to RDMA netlink interfaces to trusted administrative accounts until patches are deployed.

Patch Information

The fix has been merged across multiple stable branches. Reference commits include 137b5918931d, 5877c043398d, 6ed3d14fc45d, 87111356d58d, abda65bdd130, c26a0052ccee, f2c7b39dde2e, and fcd07d3b8ee7. Consume the fix through your distribution's kernel security updates once available.

Workarounds

Blacklist the ib_core, rdma_cm, and related InfiniBand modules on hosts that do not require RDMA functionality.
Use seccomp or AppArmor profiles to deny socket(AF_NETLINK, ..., NETLINK_RDMA) calls from untrusted workloads.
Restrict CAP_NET_ADMIN and container capabilities that enable interaction with RDMA netlink families.

bash

# Configuration example: blacklist RDMA modules on hosts that do not need them
echo 'blacklist ib_core' | sudo tee /etc/modprobe.d/blacklist-rdma.conf
echo 'blacklist rdma_cm' | sudo tee -a /etc/modprobe.d/blacklist-rdma.conf
echo 'install ib_core /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-rdma.conf
sudo update-initramfs -u