CVE-2026-53188: RDMA/core: Validate the passed in fops for ib_get_ucaps()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Validate the passed in fops for ibgetucaps()
Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same devt it can masquerade as a ucap cdev fd.
Test the fops to only accept authentic cdevs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update ib_get_ucaps() to validate the passed-in f_ops and accept only authentic RDMA character devices, preventing a block-device alias with the same dev_t from masquerading as a ucap cdev file descriptor.
Event History
Frequently Asked Questions
What access and conditions are required to exploit this issue?
An attacker needs local access with low privileges; no user interaction is required. Exploitation relies on providing a block-device file descriptor whose device number aliases an RDMA ucap character device, allowing it to masquerade as that device.
What should administrators do?
Apply an available Linux kernel patch. The fix validates the file operations associated with the supplied descriptor, rather than trusting the device number alone.