PT-2026-61073 · Linux · Linux
CVE-2026-53371
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ionic: bound node desc sysfs read with %.64s
node desc[64] in struct ib device is not guaranteed to be NUL-
terminated. The core IB sysfs handler uses "%.64s" for exactly this
reason (drivers/infiniband/core/sysfs.c:1307), since node desc store()
performs a raw memcpy of up to IB DEVICE NODE DESC MAX bytes with no NUL
termination:
memcpy(desc.node desc, buf, min t(int, count, IB DEVICE NODE DESC MAX));
If exactly 64 bytes are written via the node desc sysfs file, the array
contains no NUL byte. The ionic hca type show() handler uses unbounded
"%s" and will read past the end of node desc into adjacent fields of
struct ib device until it encounters a NUL.
ionic supports IB DEVICE MODIFY NODE DESC, so this is triggerable by
userspace.
Match the core handler and bound the format specifier.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux