CVE-2026-53176

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the iSER (iSCSI Extensions for RDMA) driver where the isert login recv done() function in drivers/infiniband/ulp/isert/ib isert.c fails to validate the lower bound of the login request payload length. A remote iSER initiator can send a login Send work request smaller than ISER HEADERS LEN (76 bytes), causing the login req len signed integer to underflow and become negative. Subsequently, the isert rx login req() function processes this negative value through a signed min() operation and passes it to memcpy(). This results in the value being sign-extended to a very large size t, leading to an out-of-bounds memory copy into the login->req buf buffer, which crashes the target node. This can be triggered before iSCSI authentication, requiring no credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.