CVE-2026-89506

RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR

Published Sep 11, 2026 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR

The original commit missed that three drivers (mthca, irdma, siw) have UHW
data associated with reg_mr that cannot be passed through the ioctl. They
also assume that the udata cannot be NULL, so failing to pass a valid
udata can trigger a NULL udata crash in those drivers.

This never happens in real systems since in rdma-core ibv_cmd_reg_mr_ex()
does not accept a udata and those three drivers don't use it, however a
malicious userspace could trigger it.

Analysis

Technical impact

A null pointer dereference occurs in the RDMA uverbs subsystem when a REG_MR ioctl is processed with a NULL udata field. The drivers mthca, irdma, and siw expect a non‑null udata pointer and crash when one is not provided, triggering a kernel bug mapped to CWE‑476.

Affected Systems

The Linux kernel RDMA drivers mthca, irdma, and siw are affected. Any kernel build that includes these drivers without applying the patch that adds support for UVERBS_ATTR_UHW to the REG_MR operation is vulnerable; the patch is introduced in commit 011199f46f44a9f. Distribution kernel versions still using the older code path are impacted.

Risk and Exploitability

The CVSS score of 4.7 indicates low‑to‑moderate severity, and the EPSS score is below 1 %. The vulnerability is not listed in CISA KEV. Exploitation requires a local user with permission to issue RDMA ioctls; remote exploitation without RDMA device access is not feasible. A local attacker can trigger a kernel crash and thereby cause a denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5b2e45049dc06a876bc6b138218ddeb0814502ef`	affected	< 71d5c41ac583df09a7c32199bef7d42de7267d07
`5b2e45049dc06a876bc6b138218ddeb0814502ef`	affected	< 9e71d0f4944ba5641e01db29b3256c963656d671
`5b2e45049dc06a876bc6b138218ddeb0814502ef`	affected	< 011199f46f44a9fd93a9e5ab5d7fd1328d80e9bf

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5b2e45049dc06a876bc6b138218ddeb0814502ef,71d5c41ac583df09a7c32199bef7d42de7267d07)`	affected	code_commit	—
`[5b2e45049dc06a876bc6b138218ddeb0814502ef,9e71d0f4944ba5641e01db29b3256c963656d671)`	affected	code_commit	—
`[5b2e45049dc06a876bc6b138218ddeb0814502ef,011199f46f44a9fd93a9e5ab5d7fd1328d80e9bf)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.17,6.17]`	affected	generic	—
`[0,6.17)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the patch adding UVERBS_ATTR_UHW handling (e.g., after commit 011199f46f44a9f).
Unload or disable the mthca, irdma, and siw modules if the system does not require RDMA functionality.
Restrict write or ioctl access to the RDMA device nodes (e.g., /dev/infiniband/*) so only trusted users or system processes can issue commands.

Generated by OpenCVE AI on September 15, 2026 at 22:24 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/011199f46f44a9fd93a9e5ab5d7fd1328d80e9bf
https://git.kernel.org/stable/c/71d5c41ac583df09a7c32199bef7d42de7267d07
https://git.kernel.org/stable/c/9e71d0f4944ba5641e01db29b3256c963656d671
https://nvd.nist.gov/vuln/detail/CVE-2026-89506
https://www.cve.org/CVERecord?id=CVE-2026-89506

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89506 https://www.cve.org/CVERecord?id=CVE-2026-89506
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid udata can trigger a NULL udata crash in those drivers. This never happens in real systems since in rdma-core ibv_cmd_reg_mr_ex() does not accept a udata and those three drivers don't use it, however a malicious userspace could trigger it.
Title		RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/011199f46f44a9fd93a9e5ab5d7fd1328d80e9bf https://git.kernel.org/stable/c/71d5c41ac583df09a7c32199bef7d42de7267d07 https://git.kernel.org/stable/c/9e71d0f4944ba5641e01db29b3256c963656d671