High 7.1Published Jun 25, 2026

CVE-2026-53187RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

Updated under an hour ago (Oct 27, 2026, 5:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc The cpu_id attribute supplied by user space through UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu() without first verifying that the value is within the valid CPU range. Passing such untrusted data to cpumask_test_cpu() may lead to an out-of-bounds read of the underlying cpumask bitmap: the helper expands to a test_bit() that indexes the bitmap by cpu_id / BITS_PER_LONG with no bound check. In addition, on kernels built with CONFIG_DEBUG_PER_CPU_MAPS it trips the WARN_ON_ONCE() in cpumask_check(); combined with panic_on_warn this turns a bad user input into a machine reboot. Reject any cpu_id that is not smaller than nr_cpu_ids with -EINVAL before it is used. Reported by Smatch.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d83edab562a496a42720902a1d2effccd05c37c5 before bd5e818be7964c1689fba2dad9e6bd3a827fee74; from d83edab562a496a42720902a1d2effccd05c37c5 before 0efbb6b54ff56300867027d8e0800d0e32226a20; from d83edab562a496a42720902a1d2effccd05c37c5 before 323c98a4ff06aa28114f2bf658fb43eb3b536bbc	CNA record
linux linux_kernel linux:linux_kernel	from 6.17 before 6.18.36; from 6.19 before 7.0.13; 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/bd5e818be7964c1689fba2dad9e6bd3a827fee74	patch
https://git.kernel.org/stable/c/0efbb6b54ff56300867027d8e0800d0e32226a20	patch
https://git.kernel.org/stable/c/323c98a4ff06aa28114f2bf658fb43eb3b536bbc	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.