CVE-2026-89507 - Vulnerability Details

- RDMA/ucma: Lock the handler in ucma_write_cm_event()

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ucma: Lock the handler in ucma_write_cm_event()

ctx->file may only be changed under the handler lock and the xa_lock, which
is what stops uevents being queued for a ctx while ucma_migrate_id() moves
it to another file. The CM core takes that lock before invoking
ucma_event_handler(), but the write() paths that queue uevents themselves
do not.

ucma_write_cm_event() re-reads ctx->file for each of its four dereferences,
so ucma_migrate_id() can swap it mid-sequence:

mutex_lock(&ctx->file->mut); /* file A */
list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */
mutex_unlock(&ctx->file->mut); /* file B */
wake_up_interruptible(&ctx->file->poll_wait); /* file B */

The window is the mutex_lock() itself: the writer sleeps in it while the
migration reassigns ctx->file. The list_add_tail() then runs on file B's
event_list holding only file A's mutex:

list_add corruption. prev->next should be next (ffff888101320f30),
but was ffff88814a08c418. (prev=ffff88814a075c18).
kernel BUG at lib/list_debug.c:32!
Call Trace:
ucma_write_cm_event+0x36e/0x5e0

and file A's mut is left held forever, wedging its next writer in D state.
The uevent is also stranded on a list ucma_cleanup_ctx_events() will not
walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no
RDMA device is involved, so an unprivileged user reaches all of this.

Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is
pinned by the ucma_get_ctx() reference.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug resides in the Linux kernel RDMA UCMA subsystem, specifically in ucma_write_cm_event. The function fails to hold the handler lock while accessing ctx->file, allowing another thread running ucma_migrate_id to change ctx->file between dereferences. This race can corrupt the linked‑list of uevents. A corrupted list triggers a kernel BUG, potentially leaving a mutex held permanently and causing subsequent writers to block, effectively hanging the system.

Affected Systems

All Linux kernels that include the UCMA CM code and expose the /dev/infiniband/rdma_cm character device with mode 0666 are affected until the upstream fix is applied. No specific release versions are currently excluded per the available information.

Risk and Exploitability

The CVSS score of 4.7 reflects a low severity, but the vulnerability allows a local unprivileged user to trigger a denial of service by corrupting the kernel event list. The EPSS score is < 1% and the issue is not listed in CISA KEV, indicating no known large‑scale exploitation. The attack vector is local: a user can queue a uevent via the RDMA CM interface, inducing the race and causing a system hang.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5`	affected	< 4f8bb11dd2ff365e7cff1c9964ab4607292d364e
`a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5`	affected	< 0be1955040a2eceed0ecfc387fdc92305411d273
`a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5`	affected	< f4cc21c6a8e9d392871477f9fd98d68e5ad80272

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5,4f8bb11dd2ff365e7cff1c9964ab4607292d364e)`	affected	code_commit	—
`[a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5,0be1955040a2eceed0ecfc387fdc92305411d273)`	affected	code_commit	—
`[a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5,f4cc21c6a8e9d392871477f9fd98d68e5ad80272)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply an updated kernel that contains the ucma_write_cm_event lock fix.
If an update is unavailable, disable the RDMA CM device by preventing access to /dev/infiniband/rdma_cm or configuring a deny‑list in udev to block the device for non‑elevated users.
Monitor kernel logs for "kernel BUG" messages in lib/list_debug.c indicating a list corruption event and take remedial action if detected.

Generated by OpenCVE AI on September 12, 2026 at 19:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0be1955040a2eceed0ecfc387fdc92305411d273
https://git.kernel.org/stable/c/4f8bb11dd2ff365e7cff1c9964ab4607292d364e
https://git.kernel.org/stable/c/f4cc21c6a8e9d392871477f9fd98d68e5ad80272
https://nvd.nist.gov/vuln/detail/CVE-2026-89507
https://www.cve.org/CVERecord?id=CVE-2026-89507

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89507 https://www.cve.org/CVERecord?id=CVE-2026-89507
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_event() ctx->file may only be changed under the handler lock and the xa_lock, which is what stops uevents being queued for a ctx while ucma_migrate_id() moves it to another file. The CM core takes that lock before invoking ucma_event_handler(), but the write() paths that queue uevents themselves do not. ucma_write_cm_event() re-reads ctx->file for each of its four dereferences, so ucma_migrate_id() can swap it mid-sequence: mutex_lock(&ctx->file->mut); /* file A / list_add_tail(&uevent->list, &ctx->file->event_list); / file B / mutex_unlock(&ctx->file->mut); / file B / wake_up_interruptible(&ctx->file->poll_wait); / file B */ The window is the mutex_lock() itself: the writer sleeps in it while the migration reassigns ctx->file. The list_add_tail() then runs on file B's event_list holding only file A's mutex: list_add corruption. prev->next should be next (ffff888101320f30), but was ffff88814a08c418. (prev=ffff88814a075c18). kernel BUG at lib/list_debug.c:32! Call Trace: ucma_write_cm_event+0x36e/0x5e0 and file A's mut is left held forever, wedging its next writer in D state. The uevent is also stranded on a list ucma_cleanup_ctx_events() will not walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no RDMA device is involved, so an unprivileged user reaches all of this. Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is pinned by the ucma_get_ctx() reference.
Title		RDMA/ucma: Lock the handler in ucma_write_cm_event()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0be1955040a2eceed0ecfc387fdc92305411d273 https://git.kernel.org/stable/c/4f8bb11dd2ff365e7cff1c9964ab4607292d364e https://git.kernel.org/stable/c/f4cc21c6a8e9d392871477f9fd98d68e5ad80272

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:54.013Z

Updated: 2026-09-13T06:30:12.335Z

Reserved: 2026-09-11T19:38:34.716Z

Link: CVE-2026-89507

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:33.027

Modified: 2026-09-13T07:17:13.700

Link: CVE-2026-89507

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:54Z

Links: CVE-2026-89507 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-12T19:45:06Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object