CVE-2026-53176

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = mi...

Affected product and versions

Product

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6

Affected versions

>= b8d26b3be8b33682cf163274ed07479a70554633 < 75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb, >= b8d26b3be8b33682cf163274ed07479a70554633 < e8a013c0c3ca2f6708341a56612a3f6d6921620a, >= b8d26b3be8b33682cf163274ed07479a70554633 < bd22740d7f14cb1c0289444cfd2c8d2938667c1d, >= b8d26b3be8b33682cf163274ed07479a70554633 < c1234229399f4af12c553b1b0ffd978eeba65548, >= b8d26b3be8b33682cf163274ed07479a70554633 < c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47, >= b8d26b3be8b33682cf163274ed07479a70554633 < df422fd273c96c2ee5beb80fc21adc8c70c29260, >= b8d26b3be8b33682cf163274ed07479a70554633 < 1ca40b243277c9e88be5e00bd3e083f71aefb93e, >= b8d26b3be8b33682cf163274ed07479a70554633 < 29e7b925ae6df64894e82ab6419994dc25580a8a, >= 3.10, >= 3.10 < 5.10.259, >= 5.11 < 5.15.210, >= 5.16 < 6.1.176, >= 6.2 < 6.6.143, >= 6.7 < 6.12.94, >= 6.13 < 6.18.36, >= 6.19 < 7.0.13, 7.1

Fixed versions

5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-191, CWE-839