RDMA Core ucaps Validation Flaw in Linux Kernel

Publication date: 2026-06-25

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ib_get_ucaps() Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same dev_t it can masquerade as a ucap cdev fd. Test the f_ops to only accept authentic cdevs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53188

EUVD

EUVD-2026-39279

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.15 (inc) to 6.18.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's RDMA core, specifically in the function ib_get_ucaps(). The issue arises because the code relied solely on the device identifier (dev_t) to validate character/block devices. However, since character and block devices can share the same dev_t, an attacker could exploit this by finding a block device with the same dev_t and masquerade as a character device file descriptor (ucap cdev fd). The fix involves validating the file operations (f_ops) to ensure only authentic character devices are accepted.

Impact Analysis

This vulnerability could allow an attacker to impersonate a character device by exploiting the shared device identifier with a block device. This masquerading could lead to unauthorized access or manipulation of device capabilities, potentially compromising system security or stability.

Hi! I’m here to help you understand CVE-2026-53188. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70