Executive brief
The Linux kernel's DIBS loopback driver (a software emulation of ISM hardware for SMC networking) contained an out-of-bounds memory write vulnerability in its move_data() function. An attacker with local access could supply a malicious offset and size that bypasses bounds checking, causing memory corruption in kernel space. This could crash the system, leak sensitive data, or lead to privilege escalation.
Technical details
The vulnerability is a classic out-of-bounds write (CWE-787) in the dibs_lo_move_data() function within drivers/dibs/dibs_loopback.c. The function performs a memcpy() into a registered Data Memory Buffer (DMB) without validating that the supplied offset plus size does not exceed the DMB's allocated length. Unlike real ISM hardware which enforces bounds natively, the software loopback implementation had no protection. A peer-supplied out-of-bounds offset or oversized write request would result in an OOB memcpy past the allocated kernel buffer. The fix adds an explicit bounds check: `if ((u64)offset + size > rmb_node->len)` before the memcpy, rejecting invalid requests with -EINVAL. Patches were merged upstream on 2026-07-09 and backported to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions with DIBS loopback driver (post-SMC DMB operations implementation)
Timeline
- 2026-08-15: disclosed
- 2026-07-09: patched: upstream patch merged