{"id":"CVE-2026-63860","state":"PUBLISHED","title":"RDMA/core: Prefer NLA_NUL_STRING","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Prefer NLA_NUL_STRING\n\nThese attributes are evaluated as c-string (passed to strcmp), but\nNLA_STRING doesn't check for the presence of a \\0 terminator.\n\nEither this needs to switch to nla_strcmp() and needs to adjust printf fmt\nspecifier to not use plain %s, or this needs to use NLA_NUL_STRING.\n\nAs the code has been this way for long time, it seems to me that userspace\ndoes include the terminating nul, even tough its not enforced so far, and\nthus NLA_NUL_STRING use is the simpler solution.","publishedAt":"2026-07-19T14:04:48.153Z","updatedAt":"2026-10-19T20:07:52.376Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"87111356d58d86edb221ba144d261ed83a5b8bbe","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"abda65bdd13084c771842adaac1f652d0660dd82","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"137b5918931d4d05aa8ea8d3adf67f7224eef63c","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"5877c043398d5fa0e93919a3d837e5cd7a98a961","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"f2c7b39dde2e61df8157066969cc2a408cd3dcd9","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"c26a0052cceed4c4d380ee5808b699f937fb58d8","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"6ed3d14fc45d3da6025e7fe4a6a09066856698e2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/core/iwpm_msg.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.16","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.141","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.91","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/core/iwpm_msg.c"]}],"references":["https://git.kernel.org/stable/c/fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf","https://git.kernel.org/stable/c/87111356d58d86edb221ba144d261ed83a5b8bbe","https://git.kernel.org/stable/c/abda65bdd13084c771842adaac1f652d0660dd82","https://git.kernel.org/stable/c/137b5918931d4d05aa8ea8d3adf67f7224eef63c","https://git.kernel.org/stable/c/5877c043398d5fa0e93919a3d837e5cd7a98a961","https://git.kernel.org/stable/c/f2c7b39dde2e61df8157066969cc2a408cd3dcd9","https://git.kernel.org/stable/c/c26a0052cceed4c4d380ee5808b699f937fb58d8","https://git.kernel.org/stable/c/6ed3d14fc45d3da6025e7fe4a6a09066856698e2"],"weaknesses":["CWE-170"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63860.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63860","state":"PUBLISHED","datePublished":"2026-07-19T14:04:48.153Z","dateUpdated":"2026-10-19T20:07:52.376Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.017Z"},"containers":{"cna":{"title":"RDMA/core: Prefer NLA_NUL_STRING","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Prefer NLA_NUL_STRING\n\nThese attributes are evaluated as c-string (passed to strcmp), but\nNLA_STRING doesn't check for the presence of a \\0 terminator.\n\nEither this needs to switch to nla_strcmp() and needs to adjust printf fmt\nspecifier to not use plain %s, or this needs to use NLA_NUL_STRING.\n\nAs the code has been this way for long time, it seems to me that userspace\ndoes include the terminating nul, even tough its not enforced so far, and\nthus NLA_NUL_STRING use is the simpler solution."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"87111356d58d86edb221ba144d261ed83a5b8bbe","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"abda65bdd13084c771842adaac1f652d0660dd82","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"137b5918931d4d05aa8ea8d3adf67f7224eef63c","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"5877c043398d5fa0e93919a3d837e5cd7a98a961","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"f2c7b39dde2e61df8157066969cc2a408cd3dcd9","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"c26a0052cceed4c4d380ee5808b699f937fb58d8","versionType":"git"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","status":"affected","lessThan":"6ed3d14fc45d3da6025e7fe4a6a09066856698e2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/core/iwpm_msg.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.16","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.141","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.91","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/core/iwpm_msg.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf"},{"url":"https://git.kernel.org/stable/c/87111356d58d86edb221ba144d261ed83a5b8bbe"},{"url":"https://git.kernel.org/stable/c/abda65bdd13084c771842adaac1f652d0660dd82"},{"url":"https://git.kernel.org/stable/c/137b5918931d4d05aa8ea8d3adf67f7224eef63c"},{"url":"https://git.kernel.org/stable/c/5877c043398d5fa0e93919a3d837e5cd7a98a961"},{"url":"https://git.kernel.org/stable/c/f2c7b39dde2e61df8157066969cc2a408cd3dcd9"},{"url":"https://git.kernel.org/stable/c/c26a0052cceed4c4d380ee5808b699f937fb58d8"},{"url":"https://git.kernel.org/stable/c/6ed3d14fc45d3da6025e7fe4a6a09066856698e2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached when userspace sends crafted NETLINK_RDMA (protocol 20) messages to the iWARP Port Mapper netlink handlers in `iwpm_register_pid_cb()` and `iwpm_mapping_info_cb()`, not from remote network packets.\nAC:L - An attacker fully controls the netlink attribute payload and can send a maximal-length string without a NUL terminator to reliably trigger unbounded `strcmp()` reads; no race or victim-dependent state is required beyond reaching the handler.\nPR:N - IWPM netlink ops lack `RDMA_NL_ADMIN_PERM`, and `netlink_sendmsg()` only enforces `CAP_NET_ADMIN` when `dst_pid` or `dst_group` is non-zero, so an unprivileged local process can send messages to the kernel RDMA netlink socket without capabilities or user-namespace tricks.\nUI:N - Exploitation requires only a local process sending a crafted netlink message; no victim interaction such as mounting a filesystem or opening a device is needed.\nS:U - Impact is confined to kernel RDMA/iWARP port-mapper state (e.g., `iwpm_user_pid`, mapping tables) within the same kernel security authority and does not cross VM, container, or IOMMU boundaries.\nC:H - `NLA_STRING` does not enforce a NUL terminator, yet `strcmp()` reads until `\\0`, causing an out-of-bounds kernel read past the attribute boundary; error paths also pass the pointer to `%s` in `pr_info()`, enabling further kernel memory disclosure.\nI:H - By sending exactly 19 bytes of `iWarpPortMapperUser` without a terminator, an attacker can make `strcmp()` read a NUL from NLA padding and pass validation, hijacking `iwpm_user_pid` and redirecting subsequent iWARP port-mapping operations to attacker-controlled userspace.\nA:H - Unbounded `strcmp()` on a non-NUL-terminated netlink attribute can read beyond the skb buffer and trigger a kernel page fault/oops, and successful port-mapper impersonation can disrupt iWARP connectivity on affected systems."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:36:38.134Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.10.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.6.141"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.12.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.18.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"7.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63860","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:32:29.749777Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-170","lang":"en","type":"CWE","description":"CWE-170 Improper Null Termination"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:07:52.376Z"}}]}}}