CVE-2026-53186

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/srp: bound SRP_RSP sense copy by the received length<br /> <br /> srp_process_rsp() copies sense data from rsp-&gt;data + resp_data_len,<br /> where resp_data_len is the full 32-bit value supplied by the SRP target<br /> and is never checked against the number of bytes actually received<br /> (wc-&gt;byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so<br /> at most 96 bytes are copied, but the source offset is not bounded.<br /> <br /> A malicious or compromised SRP target on the InfiniBand/RoCE fabric that<br /> the initiator has logged into can return an SRP_RSP with<br /> SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer<br /> is allocated at the target-chosen max_ti_iu_len, so the source of the<br /> sense copy lands past the bytes actually received; with resp_data_len<br /> near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.<br /> <br /> Copy the sense data only if it has not been truncated, that is, only if<br /> the response header, the response data, and the sense region fit within<br /> the bytes actually received; otherwise drop the sense and log. The<br /> in-tree iSER and NVMe-RDMA receive paths already bound their parse by<br /> wc-&gt;byte_len; this brings ib_srp into line with them.