CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's RDMA/srp (Remote Direct Memory Access / SCSI RDMA Protocol) subsystem, specifically in the srp_process_rsp() function. The flaw is reachable over the network from a malicious or compromised SRP target on the InfiniBand or RoCE fabric, with no authentication required from the attacker. Successful exploitation allows the attacker to read memory contents beyond the receive buffer and crash the initiator host, enabling both sensitive data disclosure and denial of service. Patched-image rebuilds at the fix commits are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must control or compromise an SRP target reachable over the InfiniBand or RoCE fabric that the initiator has logged into, making over-the-network access a prerequisite.

• AuthenticationNot required

  No authentication credential is required on the attacking target side; any SRP target the initiator has already connected to can send a crafted SRP_RSP response.

• Victim interactionNot required

  No user or administrator action is needed; the vulnerable code path executes automatically when the initiator processes a response from the fabric.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable once the attacker controls a reachable SRP target; no race conditions or special memory layout requirements must be met.

Blast Radius

• The attacker causes the initiator kernel to read memory gigabytes past the allocated receive buffer, potentially exposing kernel heap contents such as cryptographic material, session tokens, or other in-flight data structures.
• A resp_data_len value near 0xFFFFFFFF triggers a page fault in kernel context, crashing the affected host or causing an unrecoverable kernel oops that takes down all workloads on the node.
• Because the crash occurs in kernel space during RDMA response processing, all containers and processes sharing the host are terminated along with the node.