CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

Synopsis

This is an integer underflow vulnerability in the Linux kernel's iSER (iSCSI Extensions for RDMA) target driver, specifically in the IB/isert login PDU handler. A remote attacker can send a crafted login packet smaller than 76 bytes over the network, requiring no authentication, which causes a signed integer underflow that is later sign-extended into a multi-gigabyte memcpy size, corrupting kernel memory and crashing the target node. The result is a full denial of service via kernel fault, with the additional risk of out-of-bounds memory exposure. Patched-image rebuilds at the available fix versions are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the iSER target port over the network; the vulnerable code path is exercised during the iSCSI login phase, which is exposed as a network service.

• AuthenticationNot required

  No credentials are needed; the vulnerable login PDU handler runs before iSCSI authentication is performed, so any unauthenticated initiator can trigger the underflow.

• Victim interactionNot required

  The attack is fully remote and unsolicited; the target node processes the malformed login PDU without any action required from an operator or user.

• Attack complexityDetail

  Exploit reliability is high and the attack is condition-free; the attacker simply sends a login PDU shorter than 76 bytes, and no race conditions or memory layout constraints are required.

Blast Radius

• The kernel crashes outright on the target node due to a fatal out-of-bounds memcpy, taking down all workloads hosted on that node.
• Out-of-bounds kernel memory is read and copied during the oversized memcpy, potentially exposing kernel heap contents such as keys, tokens, or other in-flight data.
• Kernel memory outside the 8192-byte login buffer is overwritten before the fault, which may corrupt data structures belonging to other processes or kernel subsystems on the same host.
• Any iSER storage target reachable from an untrusted network segment is at risk, since the vulnerable path requires no prior session establishment or privilege.