Linux kernel (drivers/infiniband/core): The RDMA user-capability check identified the capability file only by device

CVSS 8.8CVE-2026-53188Firmware, BMC & network fabriccurated

Impact

The RDMA user-capability check identified the capability file only by device number, and character and block device numbers alias. A tenant that opens a block device with a colliding major/minor can pass that fd off as an authentic ucap file and be granted an RDMA user capability it was never issued - for example privileged mlx5 control or raw-QP access. The CNA scored it scope-changed, i.e. the privilege gained reaches beyond the caller's own container.

Who can reach it

A tenant container that holds /dev/infiniband/* and can open any block device node whose dev_t matches the ucap character device. Both are things a container with device access routinely has. No fabric peer and no host root needed.

What to do

Update to a stable kernel carrying 96b6e98ff12d (or aa181287ebdc / 4a1b1ac27446) and reboot. Interim: do not expose block device nodes and /dev/infiniband/* to the same untrusted container, and drop the RDMA ucap devices from tenant containers that do not need privileged verbs.

References

https://git.kernel.org/stable/c/96b6e98ff12d50ed5817230c6f1188e1150d225d https://git.kernel.org/stable/c/aa181287ebdcc53ee0ba5c2f8243e2d541ebc19b https://nvd.nist.gov/vuln/detail/CVE-2026-53188

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.