CVE-2026-53176
published 2026-06-25CVE-2026-53176: In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.40%
31.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done()
computes the login request payload length as wc->byte_len minus
ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int.
A remote iSER initiator can post a login Send work request carrying
fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows
and login_req_len becomes negative.
isert_rx_login_req() then reads that negative length back into a signed
int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the
min() is signed it keeps the negative value; the value is then passed as
the memcpy() length and sign-extended to a multi-gigabyte size_t. The
copy into the 8192-byte login->req_buf runs far out of bounds and
faults, crashing the target node. The login phase precedes iSCSI
authentication, so no credentials are required to reach this path.
Reject any login PDU shorter than ISER_HEADERS_LEN before the
subtraction, mirroring the existing early return on a failed work
completion, so login_req_len can never go negative. The upper bound was
already safe: a posted login buffer cannot deliver more than
ISER_RX_PAYLOAD_SIZE, so the difference stays at or below
MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing
lower bound needs to be added.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= b8d26b3be8b33682cf163274ed07479a70554633 < 75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb | 75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb |
| linux | linux | >= b8d26b3be8b33682cf163274ed07479a70554633 < e8a013c0c3ca2f6708341a56612a3f6d6921620a | e8a013c0c3ca2f6708341a56612a3f6d6921620a |
| linux | linux | >= b8d26b3be8b33682cf163274ed07479a70554633 < bd22740d7f14cb1c0289444cfd2c8d2938667c1d | bd22740d7f14cb1c0289444cfd2c8d2938667c1d |
| linux | linux | >= b8d26b3be8b33682cf163274ed07479a70554633 < c1234229399f4af12c553b1b0ffd978eeba65548 | c1234229399f4af12c553b1b0ffd978eeba65548 |
| linux | linux | >= b8d26b3be8b33682cf163274ed07479a70554633 < c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47 | c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47 |
| linux | linux | >= b8d26b3be8b33682cf163274ed07479a70554633 < df422fd273c96c2ee5beb80fc21adc8c70c29260 | df422fd273c96c2ee5beb80fc21adc8c70c29260 |
| linux | linux | >= b8d26b3be8b33682cf163274ed07479a70554633 < 1ca40b243277c9e88be5e00bd3e083f71aefb93e | 1ca40b243277c9e88be5e00bd3e083f71aefb93e |
| linux | linux | >= b8d26b3be8b33682cf163274ed07479a70554633 < 29e7b925ae6df64894e82ab6419994dc25580a8a | 29e7b925ae6df64894e82ab6419994dc25580a8a |
| linux | linux_kernel | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect iSER login PDUs shorter than ISER_HEADERS_LEN (76 bytes) sent to the iSCSI target port — a payload below this threshold triggers the integer underflow in isert_login_recv_done(). Monitor for abnormally short iSER login work requests during the login phase. ↗
- →The exploit path is reachable before any iSCSI authentication — monitor for kernel crashes (oops/panic) or out-of-bounds write faults originating from isert_rx_login_req()/isert_login_recv_done() in the ib_isert module, especially from unauthenticated remote sources. ↗
- →Audit kernel logs for crashes in drivers/infiniband/ulp/isert/ib_isert.c, specifically in isert_login_recv_done() or isert_rx_login_req(), which indicate exploitation attempts of this vulnerability. ↗
- ·Red Hat Enterprise Linux 6 is NOT affected by this CVE; all other major RHEL versions (7, 8, 9, 10) including kernel-rt variants are affected. ↗
- ·The vulnerability is in the iSER (iSCSI Extensions for RDMA) kernel module (ib_isert). Systems not exposing iSER targets or not loading the ib_isert module are not reachable via this attack path. ↗
- ·The upper bound on login payload size was already safe (clamped by ISER_RX_PAYLOAD_SIZE / MAX_KEY_VALUE_PAIRS); only the missing lower bound (< ISER_HEADERS_LEN / 76 bytes) needs to be patched. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
vendor_redhat·2026-06-25·CVSS 7.0
CVE-2026-53176 [HIGH] CWE-839 kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
A flaw was found in the Linux kernel's Internet Small Computer System Interface (iSCSI) Extensions for Remote Direct Memory Access (RDMA) (iSER) module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow causes a negative length to be used in a memory copy operation, resulting in an out-of-bounds write that crashes the system. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterp
VulDB
Linux Kernel up to 7.0.12 IB ib_isert.c isert_login_recv_done negative out-of-bounds (Nessus ID 323430 / WID-SEC-2026-2077)
vuldb·2026-06-29·CVSS 9.8
CVE-2026-53176 [CRITICAL] Linux Kernel up to 7.0.12 IB ib_isert.c isert_login_recv_done negative out-of-bounds (Nessus ID 323430 / WID-SEC-2026-2077)
A vulnerability was found in Linux Kernel up to 7.0.12. It has been declared as critical. Impacted is the function isert_login_recv_done of the file drivers/infiniband/ulp/isert/ib_isert.c of the component IB. Executing a manipulation of the argument negative can lead to out-of-bounds read.
This vulnerability appears as CVE-2026-53176. The attack may be performed from remote. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() comp
ghsa_unreviewed·2026-06-25
CVE-2026-53176 In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() comp
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done()
computes the login request payload length as wc->byte_len minus
ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int.
A remote iSER initiator can post a login Send work request carrying
fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows
and login_req_len becomes negative.
isert_rx_login_req() then reads that negative length back into a signed
int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the
min() is signed it keeps the negative value; the value is then passed as
the memcpy() length and sign-extended to a multi-gigabyte size_t. The
copy i
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1ca40b243277c9e88be5e00bd3e083f71aefb93ehttps://git.kernel.org/stable/c/29e7b925ae6df64894e82ab6419994dc25580a8ahttps://git.kernel.org/stable/c/75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefbhttps://git.kernel.org/stable/c/bd22740d7f14cb1c0289444cfd2c8d2938667c1dhttps://git.kernel.org/stable/c/c1234229399f4af12c553b1b0ffd978eeba65548https://git.kernel.org/stable/c/c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47https://git.kernel.org/stable/c/df422fd273c96c2ee5beb80fc21adc8c70c29260https://git.kernel.org/stable/c/e8a013c0c3ca2f6708341a56612a3f6d6921620ahttps://access.redhat.com/security/cve/CVE-2026-53176https://bugzilla.redhat.com/show_bug.cgi?id=2492741https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53176.json
2026-06-25
Published