---
id: CVE-2026-53187
title: 'RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

  The cpu_id attribute supplied by user space through
  UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpu…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d83edab562a496a42720902a1d2effccd05c37c5 <
    bd5e818be7964c1689fba2dad9e6bd3a827fee74
  - >-
    Linux >= d83edab562a496a42720902a1d2effccd05c37c5 <
    0efbb6b54ff56300867027d8e0800d0e32226a20
  - >-
    Linux >= d83edab562a496a42720902a1d2effccd05c37c5 <
    323c98a4ff06aa28114f2bf658fb43eb3b536bbc
  - Linux 6.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:26:25.299167Z'
published: '2026-06-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:35.708Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53187'
references:
  - url: 'https://git.kernel.org/stable/c/bd5e818be7964c1689fba2dad9e6bd3a827fee74'
  - url: 'https://git.kernel.org/stable/c/0efbb6b54ff56300867027d8e0800d0e32226a20'
  - url: 'https://git.kernel.org/stable/c/323c98a4ff06aa28114f2bf658fb43eb3b536bbc'
tags:
  - cve.org
epss: 0.00124
epssPercentile: 0.01909
ingestedAt: '2026-10-16T17:24:46.734Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

The cpu_id attribute supplied by user space through
UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu()
without first verifying that the value is within the valid CPU range.

Passing such untrusted data to cpumask_test_cpu() may lead to an
out-of-bounds read of the underlying cpumask bitmap: the helper expands
to a test_bit() that indexes the bitmap by cpu_id / BITS_PER_LONG with
no bound check.

In addition, on kernels built with CONFIG_DEBUG_PER_CPU_MAPS it trips
the WARN_ON_ONCE() in cpumask_check(); combined with panic_on_warn this
turns a bad user input into a machine reboot.

Reject any cpu_id that is not smaller than nr_cpu_ids with -EINVAL
before it is used.

Reported by Smatch.

## Affected

- `Linux >= d83edab562a496a42720902a1d2effccd05c37c5 < bd5e818be7964c1689fba2dad9e6bd3a827fee74`
- `Linux >= d83edab562a496a42720902a1d2effccd05c37c5 < 0efbb6b54ff56300867027d8e0800d0e32226a20`
- `Linux >= d83edab562a496a42720902a1d2effccd05c37c5 < 323c98a4ff06aa28114f2bf658fb43eb3b536bbc`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.