CVE-2026-53371: RDMA/ionic: bound node_desc sysfs read with %.64s
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ionic: bound nodedesc sysfs read with %.64s
nodedesc[64] in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/infiniband/core/sysfs.c:1307), since nodedescstore() performs a raw memcpy of up to IBDEVICENODEDESCMAX bytes with no NUL termination:
memcpy(desc.nodedesc, buf, mint(int, count, IBDEVICENODEDESCMAX));
If exactly 64 bytes are written via the nodedesc sysfs file, the array contains no NUL byte. The ionic hcatypeshow() handler uses unbounded "%s" and will read past the end of nodedesc into adjacent fields of struct ibdevice until it encounters a NUL.
ionic supports IBDEVICEMODIFYNODEDESC, so this is triggerable by userspace.
Match the core handler and bound the format specifier.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53371?
CVE-2026-53371 has a risk rating of 26.
How does CVE-2026-53371 affect Linux kernel security?
CVE-2026-53371 can lead to information disclosure due to the improper handling of non-NUL terminated strings.
How do I fix CVE-2026-53371?
To fix CVE-2026-53371, update the Linux kernel to a version where this vulnerability has been patched.
Which components are affected by CVE-2026-53371?
CVE-2026-53371 specifically affects the RDMA/ionic component in the Linux kernel.
Is CVE-2026-53371 exploitable remotely?
CVE-2026-53371 is generally not considered remotely exploitable as it requires access to the affected system.