CVE-2026-53187

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc<br /> <br /> The cpu_id attribute supplied by user space through<br /> UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu()<br /> without first verifying that the value is within the valid CPU range.<br /> <br /> Passing such untrusted data to cpumask_test_cpu() may lead to an<br /> out-of-bounds read of the underlying cpumask bitmap: the helper expands<br /> to a test_bit() that indexes the bitmap by cpu_id / BITS_PER_LONG with<br /> no bound check.<br /> <br /> In addition, on kernels built with CONFIG_DEBUG_PER_CPU_MAPS it trips<br /> the WARN_ON_ONCE() in cpumask_check(); combined with panic_on_warn this<br /> turns a bad user input into a machine reboot.<br /> <br /> Reject any cpu_id that is not smaller than nr_cpu_ids with -EINVAL<br /> before it is used.<br /> <br /> Reported by Smatch.