CVE-2026-53186: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-53186 is an out-of-bounds read vulnerability in the Linux kernel's RDMA/SRP (SCSI RDMA Protocol) module, specifically in the srp_process_rsp() function. The flaw allows a malicious or compromised SRP target on an InfiniBand/RoCE fabric to trigger a kernel page fault on the initiator system by supplying an unbounded resp_data_len value in an SRP_RSP response. The vulnerability affects the Linux kernel from version 2.6.15 through multiple stable branches, with fixes available in versions 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, and 7.1. It was published on June 25, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) (Red Hat CVE, Feedly).

The root cause is classified as CWE-130 (Improper Handling of Length Parameter Inconsistency). In srp_process_rsp(), sense data is copied from rsp->data + resp_data_len, where resp_data_len is a full 32-bit value provided by the remote SRP target and is never validated against the actual number of bytes received (wc->byte_len). While the copy length is capped at SCSI_SENSE_BUFFERSIZE (96 bytes), the source offset is unbounded — a value near 0xFFFFFFFF places the read source gigabytes past the allocated receive buffer, causing a kernel page fault. Exploitation requires the attacker to control or compromise an SRP target device on the same InfiniBand/RoCE fabric that the initiator has already logged into. The in-tree iSER and NVMe-RDMA receive paths already perform this bounds check against wc->byte_len; this fix brings ib_srp into alignment with them (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation causes a kernel page fault on the SRP initiator system, resulting in a system crash and denial of service. Because the out-of-bounds read occurs in kernel space, it may also expose sensitive kernel memory contents depending on the memory layout at the time of exploitation, posing a confidentiality risk. The CVSS v3.1 score reflects high impacts on both confidentiality and availability, with no integrity impact. Affected systems are those using the Linux kernel's ib_srp driver to connect to storage over InfiniBand or RoCE fabrics (Feedly, Red Hat CVE).

1. Gain access to the fabric: Obtain control of a malicious or compromised SRP target device on the same InfiniBand/RoCE fabric as the victim initiator (e.g., by compromising an existing storage node or deploying a rogue target).
2. Establish initiator login: Ensure the victim Linux SRP initiator has logged into the malicious target (this may already be the case in a compromised environment, or can be induced through fabric-level manipulation).
3. Craft a malicious SRP_RSP response: Prepare an SRP_RSP response packet with the SRP_RSP_FLAG_SNSVALID flag set and a resp_data_len value near 0xFFFFFFFF (e.g., 0xFFFFFFF0).
4. Send the response: Return the crafted SRP_RSP to the initiator in response to a legitimate SCSI command, causing srp_process_rsp() to attempt to read sense data from an address gigabytes past the allocated receive buffer.
5. Trigger kernel page fault: The out-of-bounds read causes a kernel page fault on the initiator, crashing the system and achieving denial of service (Feedly, Red Hat CVE).

• Logs: Kernel oops or panic messages referencing srp_process_rsp or ib_srp in /var/log/kern.log or dmesg output; kernel BUG/page fault traces involving RDMA/SRP receive paths.
• Network: Unexpected or anomalous SRP_RSP packets on the InfiniBand/RoCE fabric with unusually large resp_data_len values; rogue SRP target devices appearing on the fabric.
• Process/System: Sudden system crashes or reboots on hosts using ib_srp driver for storage connectivity; kernel crash dumps (vmcore) generated on SRP initiator nodes.
• File System: Presence of unexpected kernel crash dump files (e.g., /var/crash/) on SRP initiator systems following fabric activity.

Apply the Linux kernel patches that bound the sense data copy by validating that the response header, response data, and sense region all fit within the bytes actually received (wc->byte_len). Fixed versions are available in stable branches: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, and 7.1 (Red Hat CVE, Red Hat Bugzilla). As a network-level workaround, implement strict InfiniBand/RoCE fabric segmentation to ensure SRP initiators only connect to trusted, verified target devices. Organizations should audit their fabric topology for unauthorized or compromised SRP targets and restrict fabric access using zoning or access control lists.