CVE-2026-89508 - Vulnerability Details

- RDMA/ucma: Lock the handler in ucma_set_ib_path()

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ucma: Lock the handler in ucma_set_ib_path()

ucma_set_ib_path() calls ucma_event_handler() straight from the write()
path, without the handler lock that keeps ctx->file stable while a uevent
is queued. The handler re-reads ctx->file for every dereference:

mutex_lock(&ctx->file->mut); /* file A */
list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */
mutex_unlock(&ctx->file->mut); /* file B */
wake_up_interruptible(&ctx->file->poll_wait); /* file B */

A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION
caller sleeps in mutex_lock(), so the list_add_tail() lands on file B's
event_list while only file A's mutex is held, racing every other user of
that list:

BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0
Read of size 8 at addr ffff888153c6a418 by task poc_corr/486
Call Trace:
__list_add_valid_or_report+0x1aa/0x1c0
ucma_event_handler+0x1be/0xc00
ucma_set_ib_path+0x45e/0x710
ucma_set_option+0x32e/0x590
ucma_write+0x1f9/0x330
Allocated by task 505:
ucma_write_cm_event+0x1a1/0x660
Freed by task 505:
kfree+0x1da/0x4c0
ucma_get_event+0x5d5/0x7e0

The freed object is a ucma_event that another thread dequeued from file B's
list under file B's mutex. File A's mut is left held on top of that,
wedging its next writer in uninterruptible sleep.

This path needs a bound and address-resolved cm_id, so it requires an RDMA
device to be present.

Take the handler lock around the call.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, when ucma_set_ib_path calls the event handler without holding the handler lock, a race with ucma_migrate_id can trigger a use‑after‑free that corrupts a list and causes a kernel crash. The flaw is identified as CWE‑367 and leads to denial of service through a kernel failure.

Affected Systems

Any Linux kernel build that includes RDMA UCMA support before the upstream fix is affected. Systemsfiniband or RoCE that run the unpatched kernel are susceptible. Exact kernel version ranges are not listed, so all kernels providing these interfaces are potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is local, requiring interaction with RDMA devices via the kernel. The race condition arises only when, address‑resolved cm_id exists, so an attacker would need local access to a system with RDMA hardware to trigger the flaw.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`09e328e47a695b0d346598f5d6593ee598e64885`	affected	< 3dd07b369371a2f29e1c3caf1ade85bb92b4c551
`09e328e47a695b0d346598f5d6593ee598e64885`	affected	< b2da0d488a1c72956ebb0a57015ee8ee6a2f7748
`09e328e47a695b0d346598f5d6593ee598e64885`	affected	< a7f8d26e653ee43b0b572984b8ec544d3b3b6f3c
`09e328e47a695b0d346598f5d6593ee598e64885`	affected	< 71dc206f2e2a645dac78879768762451aa1799f7
`09e328e47a695b0d346598f5d6593ee598e64885`	affected	< 764586f8f6180084c5a7d622120f526acc6ce0c9
`09e328e47a695b0d346598f5d6593ee598e64885`	affected	< 28ac2dd416482d1c763c4af5d61af465b387fb50
`09e328e47a695b0d346598f5d6593ee598e64885`	affected	< 43a7d8ae9f645dc00235cfa4bf57673c20b769f8
`09e328e47a695b0d346598f5d6593ee598e64885`	affected	< ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[09e328e47a695b0d346598f5d6593ee598e64885,764586f8f6180084c5a7d622120f526acc6ce0c9)`	affected	code_commit	—
`[09e328e47a695b0d346598f5d6593ee598e64885,28ac2dd416482d1c763c4af5d61af465b387fb50)`	affected	code_commit	—
`[09e328e47a695b0d346598f5d6593ee598e64885,43a7d8ae9f645dc00235cfa4bf57673c20b769f8)`	affected	code_commit	—
`[09e328e47a695b0d346598f5d6593ee598e64885,ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the handler lock addition to ucma_set_ib_path().
If the patch is not yet available, unload or disable the RDMA UCMA‑related kernel modules (e.g., ib_ucma, ib_cm, ib_core) until the fix arrives.
Restrict user device permissions or udev rules for /dev/infiniband devices.

Generated by OpenCVE AI on September 15, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/28ac2dd416482d1c763c4af5d61af465b387fb50
https://git.kernel.org/stable/c/3dd07b369371a2f29e1c3caf1ade85bb92b4c551
https://git.kernel.org/stable/c/43a7d8ae9f645dc00235cfa4bf57673c20b769f8
https://git.kernel.org/stable/c/71dc206f2e2a645dac78879768762451aa1799f7
https://git.kernel.org/stable/c/764586f8f6180084c5a7d622120f526acc6ce0c9
https://git.kernel.org/stable/c/a7f8d26e653ee43b0b572984b8ec544d3b3b6f3c
https://git.kernel.org/stable/c/b2da0d488a1c72956ebb0a57015ee8ee6a2f7748
https://git.kernel.org/stable/c/ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820
https://nvd.nist.gov/vuln/detail/CVE-2026-89508
https://www.cve.org/CVERecord?id=CVE-2026-89508

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3dd07b369371a2f29e1c3caf1ade85bb92b4c551 https://git.kernel.org/stable/c/71dc206f2e2a645dac78879768762451aa1799f7 https://git.kernel.org/stable/c/a7f8d26e653ee43b0b572984b8ec544d3b3b6f3c https://git.kernel.org/stable/c/b2da0d488a1c72956ebb0a57015ee8ee6a2f7748

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89508 https://www.cve.org/CVERecord?id=CVE-2026-89508
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path() ucma_set_ib_path() calls ucma_event_handler() straight from the write() path, without the handler lock that keeps ctx->file stable while a uevent is queued. The handler re-reads ctx->file for every dereference: mutex_lock(&ctx->file->mut); /* file A / list_add_tail(&uevent->list, &ctx->file->event_list); / file B / mutex_unlock(&ctx->file->mut); / file B / wake_up_interruptible(&ctx->file->poll_wait); / file B */ A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION caller sleeps in mutex_lock(), so the list_add_tail() lands on file B's event_list while only file A's mutex is held, racing every other user of that list: BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0 Read of size 8 at addr ffff888153c6a418 by task poc_corr/486 Call Trace: __list_add_valid_or_report+0x1aa/0x1c0 ucma_event_handler+0x1be/0xc00 ucma_set_ib_path+0x45e/0x710 ucma_set_option+0x32e/0x590 ucma_write+0x1f9/0x330 Allocated by task 505: ucma_write_cm_event+0x1a1/0x660 Freed by task 505: kfree+0x1da/0x4c0 ucma_get_event+0x5d5/0x7e0 The freed object is a ucma_event that another thread dequeued from file B's list under file B's mutex. File A's mut is left held on top of that, wedging its next writer in uninterruptible sleep. This path needs a bound and address-resolved cm_id, so it requires an RDMA device to be present. Take the handler lock around the call.
Title		RDMA/ucma: Lock the handler in ucma_set_ib_path()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/28ac2dd416482d1c763c4af5d61af465b387fb50 https://git.kernel.org/stable/c/43a7d8ae9f645dc00235cfa4bf57673c20b769f8 https://git.kernel.org/stable/c/764586f8f6180084c5a7d622120f526acc6ce0c9 https://git.kernel.org/stable/c/ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:54.682Z

Updated: 2026-09-14T12:00:35.341Z

Reserved: 2026-09-11T19:38:34.716Z

Link: CVE-2026-89508

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:33.143

Modified: 2026-09-14T13:19:07.370

Link: CVE-2026-89508

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:54Z

Links: CVE-2026-89508 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:30:15Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object