Linux kernel (drivers/infiniband/core): IWARP port-mapper netlink attributes were accepted as plain strings with no

CVSS 8.4CVE-2026-63860Firmware, BMC & network fabriccurated

Impact

IWARP port-mapper netlink attributes were accepted as plain strings with no guarantee of a NUL terminator, then handed to strcmp and %s. A crafted attribute makes the kernel read past the attribute into adjacent memory - kernel memory disclosure into log output and comparisons, or an oops. The CNA scored it as requiring no privileges.

Who can reach it

Requires the ability to send RDMA_NL_IWPM netlink messages, normally the host's iwpmd port-mapper daemon. Relevant on iWARP-capable nodes (irdma in iWARP mode, cxgb4, siw); a tenant with CAP_NET_ADMIN in a non-user-namespaced net namespace, or anything that can impersonate the port mapper, reaches it. Not reachable from the fabric.

What to do

Update to a stable kernel carrying fcd07d3b8ee7 (or 87111356d58d / abda65bdd130) and reboot. Interim: do not grant CAP_NET_ADMIN over the host netlink namespace to tenant workloads, and disable iWARP mode where the fabric does not require it.

References

https://git.kernel.org/stable/c/fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf https://git.kernel.org/stable/c/87111356d58d86edb221ba144d261ed83a5b8bbe https://nvd.nist.gov/vuln/detail/CVE-2026-63860

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.