CVE-2026-53176

In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.

• CWE-191
• CWE-839

• https://git.kernel.org/stable/c/1ca40b243277c9e88be5e00bd3e083f71aefb93ePatch
• https://git.kernel.org/stable/c/29e7b925ae6df64894e82ab6419994dc25580a8aPatch
• https://git.kernel.org/stable/c/75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefbPatch
• https://git.kernel.org/stable/c/bd22740d7f14cb1c0289444cfd2c8d2938667c1dPatch
• https://git.kernel.org/stable/c/c1234229399f4af12c553b1b0ffd978eeba65548Patch
• https://git.kernel.org/stable/c/c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47Patch
• https://git.kernel.org/stable/c/df422fd273c96c2ee5beb80fc21adc8c70c29260Patch
• https://git.kernel.org/stable/c/e8a013c0c3ca2f6708341a56612a3f6d6921620aPatch
• https://access.redhat.com/security/cve/CVE-2026-53176Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2492741Issue Tracking, Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53176.jsonThird Party Advisory

Published

Jun 25, 2026

Last Modified

Jul 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53170In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-53171In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-53172In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53173In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53174In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53175In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-53177In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53178In the Linux kernel, the following vulnerability has been re…8.1
• CVE-2026-53179In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-5318A weakness has been identified in LibRaw up to 0.22.0. This …4.3
• CVE-2026-53180In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-53181In the Linux kernel, the following vulnerability has been re…5.5