Executive brief
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem could allow a local user to read sensitive information from the system's memory. This occurs when the system attempts to display certain hardware descriptions that are not properly formatted, leading to an accidental leak of adjacent data. This could potentially expose internal kernel details to an unauthorized user.
Technical details
An out-of-bounds read vulnerability exists in the ionic RDMA driver (drivers/infiniband/hw/ionic/ionic_ibdev.c) within the hca_type_show() function. The vulnerability is caused by using an unbounded '%s' format specifier when reading the node_desc array, which is not guaranteed to be NUL-terminated if exactly 64 bytes are written. Because the ionic driver supports IB_DEVICE_MODIFY_NODE_DESC, a local userspace attacker can populate this field and then read it back via sysfs to trigger the over-read into adjacent fields of the ib_device structure. The fix involves bounding the format specifier to '%.64s' to match the core InfiniBand sysfs handler.
Affected products
- Linux Linux Kernel 6.18 to 6.18.30, 7.0 to 7.0.7
Timeline
- 2026-04-07: other: Vulnerability reported by researcher
- 2026-05-14: patched: Fix committed to stable kernel branches
- 2026-07-19: disclosed: CVE published