CVE-2026-89507

Received Received - Intake

Race Condition in Linux Kernel RDMA/ucma Leading to Use-After-Free

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_event() ctx->file may only be changed under the handler lock and the xa_lock, which is what stops uevents being queued for a ctx while ucma_migrate_id() moves it to another file. The CM core takes that lock before invoking ucma_event_handler(), but the write() paths that queue uevents themselves do not. ucma_write_cm_event() re-reads ctx->file for each of its four dereferences, so ucma_migrate_id() can swap it mid-sequence: mutex_lock(&ctx->file->mut); /* file A */ list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */ mutex_unlock(&ctx->file->mut); /* file B */ wake_up_interruptible(&ctx->file->poll_wait); /* file B */ The window is the mutex_lock() itself: the writer sleeps in it while the migration reassigns ctx->file. The list_add_tail() then runs on file B's event_list holding only file A's mutex: list_add corruption. prev->next should be next (ffff888101320f30), but was ffff88814a08c418. (prev=ffff88814a075c18). kernel BUG at lib/list_debug.c:32! Call Trace: ucma_write_cm_event+0x36e/0x5e0 and file A's mut is left held forever, wedging its next writer in D state. The uevent is also stranded on a list ucma_cleanup_ctx_events() will not walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no RDMA device is involved, so an unprivileged user reaches all of this. Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is pinned by the ucma_get_ctx() reference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89507

EUVD

EUVD-2026-76413

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the RDMA subsystem. It involves a race condition in the ucma_write_cm_event() function where ctx->file is accessed without proper locking. The issue allows an unprivileged user to trigger a list corruption bug, leading to a kernel panic or system hang. The root cause is that ucma_write_cm_event() re-reads ctx->file multiple times without holding the necessary handler lock, allowing ucma_migrate_id() to change ctx->file mid-operation.

Detection Guidance

This vulnerability affects the Linux kernel's RDMA/ucma component and may lead to kernel crashes or hangs. Detection involves checking for kernel logs indicating list corruption or hangs in RDMA-related processes. Monitor system logs for errors like 'list_add corruption' or processes stuck in 'D' state. No specific commands are provided in the context.

Impact Analysis

An attacker with local access could exploit this to crash the system or cause a denial of service by triggering a kernel panic. The vulnerability allows unprivileged users to manipulate kernel memory structures, potentially leading to system instability or a complete system freeze. The /dev/infiniband/rdma_cm device being world-accessible (0666 permissions) increases the attack surface.

Mitigation Strategies

Apply the latest kernel patches or updates that resolve this issue. Since the vulnerability is in the Linux kernel, updating to a patched version is the primary mitigation. Restart affected systems after applying updates to ensure the fix is active.

Hi! I’m here to help you understand CVE-2026-89507. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70