CVE-2026-53186: Linux kernel RDMA/SRP out-of-bounds read via SRP_RSP sense data
A flaw in the Linux kernel ib_srp initiator lets a malicious or compromised SRP target trigger a read past the receive buffer when processing SRP_RSP sense data. The record gives a CNA CVSS 3.1 base score of 9.1 and lists affected kernel ranges with upstream stable fixes. No confirmed exploitation appears in the sources consulted.
Overview
The record describes an out-of-bounds read in the Linux kernel RDMA SRP initiator (ib_srp). When handling an SRP_RSP response, the sense data copy uses an offset taken from the target-supplied resp_data_len field without checking it against the number of bytes actually received. The upstream fix copies sense data only when it fits within the received bytes and otherwise drops it with a log entry.
Impact
- Confirmed: a malicious or compromised SRP target that the initiator has logged into can cause a read past the receive buffer, which faults.
- Confirmed: the CNA CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H with a base score of 9.1.
- Inference: the read fault can crash or destabilize the affected host. The record does not describe whether any data is disclosed, so the confidentiality entry in the vector should be read with that gap in mind.
Affected products and versions
- Product as recorded: Linux Linux Kernel.
- Ranges in the record: 2.6.15 up to but not including 5.10.259; 5.11 up to but not including 5.15.210; 5.16 up to but not including 6.1.176; 6.2 up to but not including 6.6.143; 6.7 up to but not including 6.12.94; 6.13 up to but not including 6.18.36; 6.19 up to but not including 7.0.13; and the development candidates 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4, 7.1-rc5, 7.1-rc6 and 7.1-rc7.
- Confirm your build by checking whether it includes the upstream stable commits listed in the references.
Exploitation status
- The record shows the CVE is not listed in CISA KEV.
- No confirmed exploitation appears in the sources consulted. The record contains no EPSS score.
Remediation and mitigation
- Update to a stable kernel release for your branch that contains the upstream fix, using the commits linked in the references.
- Distribution kernels may backport the change differently, so check your vendor advisories.
- Inference: until patching is possible, limit RDMA SRP initiator use to trusted targets and restrict who can reach InfiniBand or RoCE fabrics.
- Unknown: the record does not describe any mitigation that works without a kernel update.
Detection guidance
- Unknown: the exact log message text for dropped sense data is not in the record. Review kernel logs on patched systems for SRP-related messages about discarded sense data.
- Watch hosts that use ib_srp for unexpected kernel oops or crashes.
- Monitor the fabric for SRP sessions to targets that are not in your inventory.
Limitations of the available information
- The record has no CWE, no SSVC data, no EPSS score and no vendor severity beyond the CNA CVSS entry.
- The record does not describe exploit conditions beyond the flaw description, nor whether data disclosure occurs.
- Distribution-specific fixed versions are not provided in the record.
Frequently asked questions
What is the core problem in CVE-2026-53186?
The ib_srp initiator copies SRP_RSP sense data using a target-supplied offset that is not checked against the bytes actually received, so a crafted response can cause a read past the receive buffer.
Is this vulnerability known to be exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do?
Apply a stable kernel update for your branch that includes the upstream fix, and check your distribution vendor advisories for backported packages.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.