CVE-2026-53176

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN<br /> <br /> In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done()<br /> computes the login request payload length as wc-&gt;byte_len minus<br /> ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int.<br /> A remote iSER initiator can post a login Send work request carrying<br /> fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows<br /> and login_req_len becomes negative.<br /> <br /> isert_rx_login_req() then reads that negative length back into a signed<br /> int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the<br /> min() is signed it keeps the negative value; the value is then passed as<br /> the memcpy() length and sign-extended to a multi-gigabyte size_t. The<br /> copy into the 8192-byte login-&gt;req_buf runs far out of bounds and<br /> faults, crashing the target node. The login phase precedes iSCSI<br /> authentication, so no credentials are required to reach this path.<br /> <br /> Reject any login PDU shorter than ISER_HEADERS_LEN before the<br /> subtraction, mirroring the existing early return on a failed work<br /> completion, so login_req_len can never go negative. The upper bound was<br /> already safe: a posted login buffer cannot deliver more than<br /> ISER_RX_PAYLOAD_SIZE, so the difference stays at or below<br /> MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing<br /> lower bound needs to be added.