CVE-2026-89507 - Vulnerability Details

- RDMA/ucma: Lock the handler in ucma_write_cm_event()

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ucma: Lock the handler in ucma_write_cm_event()

ctx->file may only be changed under the handler lock and the xa_lock, which
is what stops uevents being queued for a ctx while ucma_migrate_id() moves
it to another file. The CM core takes that lock before invoking
ucma_event_handler(), but the write() paths that queue uevents themselves
do not.

ucma_write_cm_event() re-reads ctx->file for each of its four dereferences,
so ucma_migrate_id() can swap it mid-sequence:

mutex_lock(&ctx->file->mut); /* file A */
list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */
mutex_unlock(&ctx->file->mut); /* file B */
wake_up_interruptible(&ctx->file->poll_wait); /* file B */

The window is the mutex_lock() itself: the writer sleeps in it while the
migration reassigns ctx->file. The list_add_tail() then runs on file B's
event_list holding only file A's mutex:

list_add corruption. prev->next should be next (ffff888101320f30),
but was ffff88814a08c418. (prev=ffff88814a075c18).
kernel BUG at lib/list_debug.c:32!
Call Trace:
ucma_write_cm_event+0x36e/0x5e0

and file A's mut is left held forever, wedging its next writer in D state.
The uevent is also stranded on a list ucma_cleanup_ctx_events() will not
walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no
RDMA device is involved, so an unprivileged user reaches all of this.

Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is
pinned by the ucma_get_ctx() reference.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition exists in the Linux kernel RDMA UCMA subsystem where ucma_write_cm_event() reads ctx->file multiple times without holding the handler lock while a concurrent ucma_migrate_id() may change it between reads. This can lead to corruption of the kernel linked‑list that queues uevents, causing a kernel BUG, leaving a mutex locked forever and hanging subsequent writers. The outcome is a local denial of service that can force the system to become unavailable or crash.

Affected Systems

All Linux kernels that include the UCMA CM code and expose the /dev/infiniband/rdma_cm character device with mode 0666 are affected until the upstream fix is applied. No specific release versions are listed, so any kernel that contains the UCMA core and the RDMA CM device is vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation is currently documented. The likely attack vector is local, requiring an unprivileged user to interact with /dev/infiniband/rdma_cm and trigger the race that leads to list corruption and a deadlock.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5`	affected	< 4f8bb11dd2ff365e7cff1c9964ab4607292d364e
`a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5`	affected	< 0be1955040a2eceed0ecfc387fdc92305411d273
`a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5`	affected	< f4cc21c6a8e9d392871477f9fd98d68e5ad80272

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5,4f8bb11dd2ff365e7cff1c9964ab4607292d364e)`	affected	code_commit	—
`[a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5,0be1955040a2eceed0ecfc387fdc92305411d273)`	affected	code_commit	—
`[a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5,f4cc21c6a8e9d392871477f9fd98d68e5ad80272)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the upstream kernel patch that locks ctx->file in ucma_write_cm_event() to eliminate the race condition.
If a kernel update cannot be applied immediately, restrict access to /dev/infiniband/rdma_cm by changing its permissions or using a device deny list, limiting the ability of non‑kernel users to trigger the vulnerability.
Continuously monitor kernel logs for 'kernel BUG' entries related to lib/list_debug.c and investigate any uevent list corruption events.

Generated by OpenCVE AI on September 15, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0be1955040a2eceed0ecfc387fdc92305411d273
https://git.kernel.org/stable/c/4f8bb11dd2ff365e7cff1c9964ab4607292d364e
https://git.kernel.org/stable/c/f4cc21c6a8e9d392871477f9fd98d68e5ad80272
https://nvd.nist.gov/vuln/detail/CVE-2026-89507
https://www.cve.org/CVERecord?id=CVE-2026-89507

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89507 https://www.cve.org/CVERecord?id=CVE-2026-89507
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_event() ctx->file may only be changed under the handler lock and the xa_lock, which is what stops uevents being queued for a ctx while ucma_migrate_id() moves it to another file. The CM core takes that lock before invoking ucma_event_handler(), but the write() paths that queue uevents themselves do not. ucma_write_cm_event() re-reads ctx->file for each of its four dereferences, so ucma_migrate_id() can swap it mid-sequence: mutex_lock(&ctx->file->mut); /* file A / list_add_tail(&uevent->list, &ctx->file->event_list); / file B / mutex_unlock(&ctx->file->mut); / file B / wake_up_interruptible(&ctx->file->poll_wait); / file B */ The window is the mutex_lock() itself: the writer sleeps in it while the migration reassigns ctx->file. The list_add_tail() then runs on file B's event_list holding only file A's mutex: list_add corruption. prev->next should be next (ffff888101320f30), but was ffff88814a08c418. (prev=ffff88814a075c18). kernel BUG at lib/list_debug.c:32! Call Trace: ucma_write_cm_event+0x36e/0x5e0 and file A's mut is left held forever, wedging its next writer in D state. The uevent is also stranded on a list ucma_cleanup_ctx_events() will not walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no RDMA device is involved, so an unprivileged user reaches all of this. Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is pinned by the ucma_get_ctx() reference.
Title		RDMA/ucma: Lock the handler in ucma_write_cm_event()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0be1955040a2eceed0ecfc387fdc92305411d273 https://git.kernel.org/stable/c/4f8bb11dd2ff365e7cff1c9964ab4607292d364e https://git.kernel.org/stable/c/f4cc21c6a8e9d392871477f9fd98d68e5ad80272

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:54.013Z

Updated: 2026-09-13T06:30:12.335Z

Reserved: 2026-09-11T19:38:34.716Z

Link: CVE-2026-89507

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:33.027

Modified: 2026-09-13T07:17:13.700

Link: CVE-2026-89507

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:54Z

Links: CVE-2026-89507 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:30:15Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object