CVE-2026-53187 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and take steps to mitigate it. This vulnerability has been assigned a HIGH severity rating and could potentially lead to a machine reboot. Linux kernel developers and maintainers should also be aware of this vulnerability and ensure that their systems are updated to the latest version.

Technical summary

The Linux kernel's RDMA/core DMAH alloc vulnerability allows an untrusted user space cpu_id attribute to be passed directly to cpumask_test_cpu() without verification. This could lead to an out-of-bounds read of the underlying cpumask bitmap. The vulnerability is caused by a lack of bounds checking on the cpu_id attribute. The vulnerability has been fixed by rejecting any cpu_id that is not smaller than nr_cpu_ids with -EINVAL. This fix prevents the potential out-of-bounds read and ensures that the system remains stable.

Defensive priority

High priority should be given to updating Linux kernel systems to the latest version to mitigate this vulnerability. Linux kernel users and administrators should also ensure that their systems are configured to receive and apply security updates in a timely manner.

Recommended defensive actions

• Update Linux kernel systems to the latest version
• Ensure systems are configured to receive and apply security updates in a timely manner
• Monitor systems for potential exploitation attempts
• Implement additional security controls to prevent exploitation
• Review and update incident response plans to address potential exploitation

Evidence notes

The vulnerability was reported by Smatch and has been assigned a CVSS score of 7.1 and a HIGH severity rating. The vulnerability has been fixed by rejecting any cpu_id that is not smaller than nr_cpu_ids with -EINVAL. Linux kernel users and administrators should be aware of this vulnerability and take steps to mitigate it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.