CVE-2026-89506

Received Received - Intake

RDMA/uverbs NULL udata Crash in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid udata can trigger a NULL udata crash in those drivers. This never happens in real systems since in rdma-core ibv_cmd_reg_mr_ex() does not accept a udata and those three drivers don't use it, however a malicious userspace could trigger it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89506

EUVD

EUVD-2026-76412

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing check in the RDMA/uverbs subsystem. A commit added UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR but failed to account for three drivers (mthca, irdma, siw) that handle user data (UHW) differently. These drivers expect valid user data and do not handle NULL user data properly, which could lead to a crash if a malicious userspace application triggers it.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/uverbs subsystem and requires kernel-level access to detect. There are no direct network commands to detect it. You would need to check your kernel version and verify if it includes the vulnerable code path. Use uname -a to check your kernel version and compare it against patched versions.

Impact Analysis

This vulnerability could allow a malicious userspace application to crash the system by triggering a NULL pointer dereference in the affected RDMA drivers. This may lead to denial of service or potential privilege escalation if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to RDMA/uverbs memory registration that could cause a NULL pointer dereference in specific drivers. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the affected RDMA drivers (mthca, irdma, siw) if they are not in use. Monitor vendor advisories for kernel updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-89506. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70