CVE-2026-53187: RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Validate cpuid against nrcpuids in DMAH alloc
The cpuid attribute supplied by user space through UVERBSATTRALLOCDMAHCPUID is passed directly to cpumasktestcpu() without first verifying that the value is within the valid CPU range.
Passing such untrusted data to cpumasktestcpu() may lead to an out-of-bounds read of the underlying cpumask bitmap: the helper expands to a testbit() that indexes the bitmap by cpuid / BITSPERLONG with no bound check.
In addition, on kernels built with CONFIGDEBUGPERCPUMAPS it trips the WARNONONCE() in cpumaskcheck(); combined with paniconwarn this turns a bad user input into a machine reboot.
Reject any cpuid that is not smaller than nrcpuids with -EINVAL before it is used.
Reported by Smatch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In RDMA/core, validate the user-supplied UVERBS_ATTR_ALLOC_DMAH_CPU_ID before calling cpumask_test_cpu(); reject any cpu_id that is not smaller than nr_cpu_ids and return -EINVAL.
Linux kernel (RDMA/core) Validate cpu_id against nr_cpu_ids = Reject cpu_id >= nr_cpu_ids with -EINVAL