CVE-2026-53186 (GCVE-0-2026-53186)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-08-05 12:33
VLAI
Title
RDMA/srp: bound SRP_RSP sense copy by the received length
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 , < 3889517c2ec7f364914aea8209abfff735f7ecde (git)
Affected: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 , < ed77cc819ad631264787cade5ae5ec4c535ec6bb (git)
Affected: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 , < 0b9ee09d5e849591f17d98c078033dadea967293 (git)
Affected: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 , < 0d64bc200ebe4f275b27438c6e593903e0b16fe1 (git)
Affected: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 , < 2015038195939eac54a1ee83c9d98ef1a8ccbbce (git)
Affected: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 , < f92a285db7ff6e598591ccbfb551be155c5f4d57 (git)
Affected: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 , < 3523e53ff95f1837ec3f57ff7558532bcb2661b7 (git)
Affected: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 , < 13e91fd076306f5d0cdfa14f53d69e37274723c4 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.15
Unaffected: 0 , < 2.6.15 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.94 , ≤ 6.12.* (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srp/ib_srp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3889517c2ec7f364914aea8209abfff735f7ecde",
              "status": "affected",
              "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
              "versionType": "git"
            },
            {
              "lessThan": "ed77cc819ad631264787cade5ae5ec4c535ec6bb",
              "status": "affected",
              "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
              "versionType": "git"
            },
            {
              "lessThan": "0b9ee09d5e849591f17d98c078033dadea967293",
              "status": "affected",
              "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
              "versionType": "git"
            },
            {
              "lessThan": "0d64bc200ebe4f275b27438c6e593903e0b16fe1",
              "status": "affected",
              "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
              "versionType": "git"
            },
            {
              "lessThan": "2015038195939eac54a1ee83c9d98ef1a8ccbbce",
              "status": "affected",
              "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
              "versionType": "git"
            },
            {
              "lessThan": "f92a285db7ff6e598591ccbfb551be155c5f4d57",
              "status": "affected",
              "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
              "versionType": "git"
            },
            {
              "lessThan": "3523e53ff95f1837ec3f57ff7558532bcb2661b7",
              "status": "affected",
              "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
              "versionType": "git"
            },
            {
              "lessThan": "13e91fd076306f5d0cdfa14f53d69e37274723c4",
              "status": "affected",
              "version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srp/ib_srp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: bound SRP_RSP sense copy by the received length\n\nsrp_process_rsp() copies sense data from rsp-\u003edata + resp_data_len,\nwhere resp_data_len is the full 32-bit value supplied by the SRP target\nand is never checked against the number of bytes actually received\n(wc-\u003ebyte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so\nat most 96 bytes are copied, but the source offset is not bounded.\n\nA malicious or compromised SRP target on the InfiniBand/RoCE fabric that\nthe initiator has logged into can return an SRP_RSP with\nSRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer\nis allocated at the target-chosen max_ti_iu_len, so the source of the\nsense copy lands past the bytes actually received; with resp_data_len\nnear 0xFFFFFFFF it is gigabytes past the buffer and the read faults.\n\nCopy the sense data only if it has not been truncated, that is, only if\nthe response header, the response data, and the sense region fit within\nthe bytes actually received; otherwise drop the sense and log. The\nin-tree iSER and NVMe-RDMA receive paths already bound their parse by\nwc-\u003ebyte_len; this brings ib_srp into line with them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SRP target can trigger this by sending an SRP_RSP over the established RDMA network session to the initiator. The vulnerable parsing is reached from remote peer-controlled RDMA receive completions, not from local or physical access.\nAC:L - The target controls SRP_RSP flags and length fields and sees the command tag in each SRP_CMD, so it can craft a matching response with SRP_RSP_FLAG_SNSVALID and an oversized resp_data_len. No race or hard-to-control environmental condition is required.\nPR:N - The attacker needs control of the remote SRP target or a compromised target on the fabric, but no privileges on the vulnerable initiator host. The vulnerable receive path processes target responses after the initiator is connected.\nUI:N - Once the initiator is logged into the target, the target can trigger the bug by responding to normal SCSI commands or scan traffic. No additional victim user action is needed for the malicious SRP_RSP to be processed.\nS:U - The impact is within the vulnerable kernel instance processing the SRP response. This is not a guest-to-host escape, IOMMU bypass, or other cross-authority boundary change.\nC:H - The target-controlled offset can make the kernel read out of bounds from memory beyond the SRP receive buffer, with up to SCSI_SENSE_BUFFERSIZE bytes copied into sense data. Under the required higher-severity rule, this out-of-bounds kernel read is treated as high confidentiality impact.\nI:N - The bug is an out-of-bounds read source for a copy into the intended SCSI sense buffer, not an out-of-bounds write or control-flow overwrite. The target can already provide arbitrary valid sense data, so this flaw does not add a distinct kernel integrity primitive.\nA:H - With a large resp_data_len, the copy source can land far beyond the receive buffer and fault in kernel context, causing an oops or panic. The malicious target can repeat this by sending crafted responses."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:53.227Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce"
        },
        {
          "url": "https://git.kernel.org/stable/c/f92a285db7ff6e598591ccbfb551be155c5f4d57"
        },
        {
          "url": "https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4"
        }
      ],
      "title": "RDMA/srp: bound SRP_RSP sense copy by the received length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53186",
    "datePublished": "2026-06-25T08:38:59.508Z",
    "dateReserved": "2026-06-09T07:44:35.390Z",
    "dateUpdated": "2026-08-05T12:33:53.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53186",
      "date": "2026-08-06",
      "epss": "0.00514",
      "percentile": "0.40972"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:48:39.000Z",
      "cve": "CVE-2026-53186",
      "id": "msrc_CVE-2026-53186",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/srp: bound SRP_RSP sense copy by the received length",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53186.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53186\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-25T09:16:36.020\",\"lastModified\":\"2026-07-06T12:41:25.363\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/srp: bound SRP_RSP sense copy by the received length\\n\\nsrp_process_rsp() copies sense data from rsp-\u003edata + resp_data_len,\\nwhere resp_data_len is the full 32-bit value supplied by the SRP target\\nand is never checked against the number of bytes actually received\\n(wc-\u003ebyte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so\\nat most 96 bytes are copied, but the source offset is not bounded.\\n\\nA malicious or compromised SRP target on the InfiniBand/RoCE fabric that\\nthe initiator has logged into can return an SRP_RSP with\\nSRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer\\nis allocated at the target-chosen max_ti_iu_len, so the source of the\\nsense copy lands past the bytes actually received; with resp_data_len\\nnear 0xFFFFFFFF it is gigabytes past the buffer and the read faults.\\n\\nCopy the sense data only if it has not been truncated, that is, only if\\nthe response header, the response data, and the sense region fit within\\nthe bytes actually received; otherwise drop the sense and log. The\\nin-tree iSER and NVMe-RDMA receive paths already bound their parse by\\nwc-\u003ebyte_len; this brings ib_srp into line with them.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/ulp/srp/ib_srp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aef9ec39c47f0cece886ddd6b53c440321e0b2a6\",\"lessThan\":\"3889517c2ec7f364914aea8209abfff735f7ecde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aef9ec39c47f0cece886ddd6b53c440321e0b2a6\",\"lessThan\":\"ed77cc819ad631264787cade5ae5ec4c535ec6bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aef9ec39c47f0cece886ddd6b53c440321e0b2a6\",\"lessThan\":\"0b9ee09d5e849591f17d98c078033dadea967293\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aef9ec39c47f0cece886ddd6b53c440321e0b2a6\",\"lessThan\":\"0d64bc200ebe4f275b27438c6e593903e0b16fe1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aef9ec39c47f0cece886ddd6b53c440321e0b2a6\",\"lessThan\":\"2015038195939eac54a1ee83c9d98ef1a8ccbbce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aef9ec39c47f0cece886ddd6b53c440321e0b2a6\",\"lessThan\":\"f92a285db7ff6e598591ccbfb551be155c5f4d57\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aef9ec39c47f0cece886ddd6b53c440321e0b2a6\",\"lessThan\":\"3523e53ff95f1837ec3f57ff7558532bcb2661b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aef9ec39c47f0cece886ddd6b53c440321e0b2a6\",\"lessThan\":\"13e91fd076306f5d0cdfa14f53d69e37274723c4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/ulp/srp/ib_srp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.94\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.36\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.15\",\"versionEndExcluding\":\"5.10.259\",\"matchCriteriaId\":\"83AFCE02-A944-4709-817B-357BAB817063\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.210\",\"matchCriteriaId\":\"5E938CDF-D1C4-43D0-98DC-9E11B6B55801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.176\",\"matchCriteriaId\":\"C4446623-5F2B-4DD8-8666-9FAAC285A757\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.143\",\"matchCriteriaId\":\"9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.94\",\"matchCriteriaId\":\"85421C0C-ABDE-4357-971C-67F9087DE1B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.36\",\"matchCriteriaId\":\"389025D2-958D-41BD-BD96-70ED1033A9F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.13\",\"matchCriteriaId\":\"6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"1039E95A-8CC3-4C88-8FF9-5C08EEB861C9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f92a285db7ff6e598591ccbfb551be155c5f4d57\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-26T01:07:15+00:00",
      "cve": "CVE-2026-53186",
      "id": "CVE-2026-53186",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/srp: bound SRP_RSP sense copy by the received length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53186.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-21T23:50:24Z",
      "cve": "CVE-2026-53186",
      "id": "CVE-2026-53186",
      "initial_release_date": "2026-06-26T02:10:48Z",
      "product_status:known_affected": "289",
      "product_status:recommended": "98",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53186",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53186.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.