CVE-2026-53371

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ionic: bound node_desc sysfs read with %.64s

nodedesc[64] in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/infiniband/core/sysfs.c:1307), since nodedescstore() performs a raw memcpy of up to IBDEVICENODEDESCMAX bytes with no NUL termination:

memcpy(desc.nodedesc, buf, mint(int, count, IBDEVICENODEDESCMAX));

If exactly 64 bytes are written via the nodedesc sysfs file, the array contains no NUL byte. The ionic hcatypeshow() handler uses unbounded "%s" and will read past the end of nodedesc into adjacent fields of struct ib_device until it encounters a NUL.

ionic supports IBDEVICEMODIFYNODEDESC, so this is triggerable by userspace.

Match the core handler and bound the format specifier.