CVE-2026-53133RDMA/umem: Fix truncation for block sizes >= 4G
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix truncation for block sizes >= 4G When the iommu is used the linearization of the mapping can give a single block that is very large split across multiple SG entries. When __rdma_block_iter_next() reassembles the split SG entries it is overflowing the 32 bit stack values and computed the wrong DMA addresses for blocks after the truncation. Use the right types to hold DMA addresses.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a808273a495c657e33281b181fd7fcc2bb28f662 before 2ff4b7817e5b78070c30f5fb5e678e452a2628b3; from a808273a495c657e33281b181fd7fcc2bb28f662 before dee2a49adeeb2a5e16a3fc858fa21b841c519802; from a808273a495c657e33281b181fd7fcc2bb28f662 before cc644d5608e3b0dadc970bd6e6aa26b91ea07d0f; from a808273a495c657e33281b181fd7fcc2bb28f662 before 8fe0231adebe086c8a459c790944ac026cd99c6e; from a808273a495c657e33281b181fd7fcc2bb28f662 before baf8685bcf56dc1efb44b8f6a57c42516e549068; from a808273a495c657e33281b181fd7fcc2bb28f662 before afd35fec9297195b759078745549c2671223f24f; from a808273a495c657e33281b181fd7fcc2bb28f662 before ac1aad8e1281534ce936c250f68084fc79c5469e; from a808273a495c657e33281b181fd7fcc2bb28f662 before 15fe76e23615f502d051ef0768f86babaf08746c | CNA record |
linux linux_kernel linux:linux_kernel | from 5.2 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; and 6 more ranges | NVD |
References
- https://git.kernel.org/stable/c/2ff4b7817e5b78070c30f5fb5e678e452a2628b3patch
- https://git.kernel.org/stable/c/dee2a49adeeb2a5e16a3fc858fa21b841c519802patch
- https://git.kernel.org/stable/c/cc644d5608e3b0dadc970bd6e6aa26b91ea07d0fpatch
- https://git.kernel.org/stable/c/8fe0231adebe086c8a459c790944ac026cd99c6epatch
- https://git.kernel.org/stable/c/baf8685bcf56dc1efb44b8f6a57c42516e549068patch
- https://git.kernel.org/stable/c/afd35fec9297195b759078745549c2671223f24fpatch
- https://git.kernel.org/stable/c/ac1aad8e1281534ce936c250f68084fc79c5469epatch
- https://git.kernel.org/stable/c/15fe76e23615f502d051ef0768f86babaf08746cpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.