Linux kernel - SRP (SCSI RDMA Protocol) initiator, drivers/infiniband/ulp/srp/ib_srp.c: The SRP initiator copied the

CVSS 9.1CVE-2026-53186Firmware, BMC & network fabricRDMA/srp SRP_RSP sense buffer overrunSCSI RDMA Protocol initiatorcurated

Impact

The SRP initiator copied the sense data out of an SRP_RSP without bounding the copy by the length actually received, so a malicious or compromised SRP target can overrun the initiator's buffer and read host kernel memory or crash the node. This inverts the usual threat direction - here the storage array attacks its clients. In a GPU cluster where an array or a software SRP target serves many compute nodes, one compromised target reaches every node that mounts from it, which is a fleet-wide blast radius from a single storage compromise.

Who can reach it

The attacker controls or has compromised an SRP target the victim connects to, and returns an SRP_RSP whose declared sense length exceeds what was received. No credentials on the victim are needed beyond it being a normal client of the target. Also reachable by an attacker who can inject into the SRP connection using the RDMA packet-injection primitives.

What to do

Host reboot / kernel upgrade on all SRP initiator nodes. Interim: verify SRP targets are on a management-isolated storage fabric with per-tenant partitioning so an untrusted party cannot stand up a rogue target and attract connections; that is a switch/SM config change. If SRP is legacy in your environment and NVMe-oF has replaced it, unload ib_srp and remove the initiator configuration entirely - a config change that eliminates the surface.

References

https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-53186.json https://nvd.nist.gov/vuln/detail/CVE-2026-53186

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.