Riskcovery

CVE-2026-53187

RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

State
Published
Severity
7.1 High
Published
Jun 25, 2026
Updated
Oct 19, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

The cpu_id attribute supplied by user space through UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu() without first verifying that the value is within the valid CPU range.

Passing such untrusted data to cpumask_test_cpu() may lead to an out-of-bounds read of the underlying cpumask bitmap: the helper expands to a test_bit() that indexes the bitmap by cpu_id / BITS_PER_LONG with no bound check.

In addition, on kernels built with CONFIG_DEBUG_PER_CPU_MAPS it trips the WARN_ON_ONCE() in cpumask_check(); combined with panic_on_warn this turns a bad user input into a machine reboot.

Reject any cpu_id that is not smaller than nr_cpu_ids with -EINVAL before it is used.

Reported by Smatch.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • d83edab562a496a42720902a1d2effccd05c37c5 to before bd5e818be7964c1689fba2dad9e6bd3a827fee74Affected
  • d83edab562a496a42720902a1d2effccd05c37c5 to before 0efbb6b54ff56300867027d8e0800d0e32226a20Affected
  • d83edab562a496a42720902a1d2effccd05c37c5 to before 323c98a4ff06aa28114f2bf658fb43eb3b536bbcAffected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.36 through 6.18.*Not affected
  • 7.0.13 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.