GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89507 (GCVE-0-2026-89507)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-13 06:30
VLAI
Title
RDMA/ucma: Lock the handler in ucma_write_cm_event()
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_event() ctx->file may only be changed under the handler lock and the xa_lock, which is what stops uevents being queued for a ctx while ucma_migrate_id() moves it to another file. The CM core takes that lock before invoking ucma_event_handler(), but the write() paths that queue uevents themselves do not. ucma_write_cm_event() re-reads ctx->file for each of its four dereferences, so ucma_migrate_id() can swap it mid-sequence: mutex_lock(&ctx->file->mut); /* file A */ list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */ mutex_unlock(&ctx->file->mut); /* file B */ wake_up_interruptible(&ctx->file->poll_wait); /* file B */ The window is the mutex_lock() itself: the writer sleeps in it while the migration reassigns ctx->file. The list_add_tail() then runs on file B's event_list holding only file A's mutex: list_add corruption. prev->next should be next (ffff888101320f30), but was ffff88814a08c418. (prev=ffff88814a075c18). kernel BUG at lib/list_debug.c:32! Call Trace: ucma_write_cm_event+0x36e/0x5e0 and file A's mut is left held forever, wedging its next writer in D state. The uevent is also stranded on a list ucma_cleanup_ctx_events() will not walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no RDMA device is involved, so an unprivileged user reaches all of this. Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is pinned by the ucma_get_ctx() reference.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5 , < 4f8bb11dd2ff365e7cff1c9964ab4607292d364e (git)
Affected: a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5 , < 0be1955040a2eceed0ecfc387fdc92305411d273 (git)
Affected: a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5 , < f4cc21c6a8e9d392871477f9fd98d68e5ad80272 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/ucma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4f8bb11dd2ff365e7cff1c9964ab4607292d364e",
              "status": "affected",
              "version": "a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5",
              "versionType": "git"
            },
            {
              "lessThan": "0be1955040a2eceed0ecfc387fdc92305411d273",
              "status": "affected",
              "version": "a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5",
              "versionType": "git"
            },
            {
              "lessThan": "f4cc21c6a8e9d392871477f9fd98d68e5ad80272",
              "status": "affected",
              "version": "a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/ucma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Lock the handler in ucma_write_cm_event()\n\nctx-\u003efile may only be changed under the handler lock and the xa_lock, which\nis what stops uevents being queued for a ctx while ucma_migrate_id() moves\nit to another file.  The CM core takes that lock before invoking\nucma_event_handler(), but the write() paths that queue uevents themselves\ndo not.\n\nucma_write_cm_event() re-reads ctx-\u003efile for each of its four dereferences,\nso ucma_migrate_id() can swap it mid-sequence:\n\n\tmutex_lock(\u0026ctx-\u003efile-\u003emut);\t\t\t/* file A */\n\tlist_add_tail(\u0026uevent-\u003elist, \u0026ctx-\u003efile-\u003eevent_list);\t/* file B */\n\tmutex_unlock(\u0026ctx-\u003efile-\u003emut);\t\t\t/* file B */\n\twake_up_interruptible(\u0026ctx-\u003efile-\u003epoll_wait);\t/* file B */\n\nThe window is the mutex_lock() itself: the writer sleeps in it while the\nmigration reassigns ctx-\u003efile.  The list_add_tail() then runs on file B\u0027s\nevent_list holding only file A\u0027s mutex:\n\n  list_add corruption. prev-\u003enext should be next (ffff888101320f30),\n    but was ffff88814a08c418. (prev=ffff88814a075c18).\n  kernel BUG at lib/list_debug.c:32!\n  Call Trace:\n   ucma_write_cm_event+0x36e/0x5e0\n\nand file A\u0027s mut is left held forever, wedging its next writer in D state.\nThe uevent is also stranded on a list ucma_cleanup_ctx_events() will not\nwalk, so it outlives its context.  /dev/infiniband/rdma_cm is 0666 and no\nRDMA device is involved, so an unprivileged user reaches all of this.\n\nTake the handler lock, as ucma_cleanup_mc_events() does; ctx-\u003ecm_id is\npinned by the ucma_get_ctx() reference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached by write() on the local misc device /dev/infiniband/rdma_cm (ucma_write \u2192 WRITE_CM_EVENT racing MIGRATE_ID). Remote RDMA CM packet handling already takes the handler lock in ucma_event_handler(), so this bug is not a network-packet path.\nAC:L - The attacker fully controls both sides of the race: one thread issues WRITE_CM_EVENT while another issues MIGRATE_ID on the same ctx, and can hold file A\u0027s mutex from a third thread so the writer sleeps in mutex_lock() across ctx-\u003efile reassignment.\nPR:L - ucma registers /dev/infiniband/rdma_cm with mode 0666 and the command path (create_id, write_cm_event, migrate_id) has no capability checks. No RDMA hardware is required (ucma_get_ctx, not ucma_get_ctx_dev), so any unprivileged local user can open the device and trigger the bug.\nUI:N - Exploitation uses only the attacker\u0027s own open/write syscalls against rdma_cm; no other user or administrator action is required.\nS:U - This is in-kernel list corruption and use-after-free within the host kernel\u0027s security authority. It can escalate privileges on the host but does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The unlocked list_add can strand a uevent on another file\u0027s list so it outlives its ucma_context, and concurrent GET_EVENT can free a ucma_event still being linked (UAF). Per UAF guidance that enables attacker-controlled reuse and arbitrary kernel reads.\nI:H - list_add_tail on file B\u0027s event_list while holding only file A\u0027s mutex, plus mutex_unlock of an unheld mutex, corrupts kernel lists; combined with UAF of ctx/uevent this yields heap-sprayable write and list-unlink primitives for control-flow hijacking.\nA:H - The race was reproduced as kernel BUG at lib/list_debug.c:32 in ucma_write_cm_event, and file A\u0027s mutex is left held forever wedging later writers in D-state. UAFs also oops, so availability impact is high even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:12.335Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4f8bb11dd2ff365e7cff1c9964ab4607292d364e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0be1955040a2eceed0ecfc387fdc92305411d273"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4cc21c6a8e9d392871477f9fd98d68e5ad80272"
        }
      ],
      "title": "RDMA/ucma: Lock the handler in ucma_write_cm_event()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89507",
    "datePublished": "2026-09-11T19:43:54.013Z",
    "dateReserved": "2026-09-11T19:38:34.716Z",
    "dateUpdated": "2026-09-13T06:30:12.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89507",
      "date": "2026-09-16",
      "epss": "0.00127",
      "percentile": "0.02717"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89507\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:33.027\",\"lastModified\":\"2026-09-13T07:17:13.700\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/ucma: Lock the handler in ucma_write_cm_event()\\n\\nctx-\u003efile may only be changed under the handler lock and the xa_lock, which\\nis what stops uevents being queued for a ctx while ucma_migrate_id() moves\\nit to another file.  The CM core takes that lock before invoking\\nucma_event_handler(), but the write() paths that queue uevents themselves\\ndo not.\\n\\nucma_write_cm_event() re-reads ctx-\u003efile for each of its four dereferences,\\nso ucma_migrate_id() can swap it mid-sequence:\\n\\n\\tmutex_lock(\u0026ctx-\u003efile-\u003emut);\\t\\t\\t/* file A */\\n\\tlist_add_tail(\u0026uevent-\u003elist, \u0026ctx-\u003efile-\u003eevent_list);\\t/* file B */\\n\\tmutex_unlock(\u0026ctx-\u003efile-\u003emut);\\t\\t\\t/* file B */\\n\\twake_up_interruptible(\u0026ctx-\u003efile-\u003epoll_wait);\\t/* file B */\\n\\nThe window is the mutex_lock() itself: the writer sleeps in it while the\\nmigration reassigns ctx-\u003efile.  The list_add_tail() then runs on file B\u0027s\\nevent_list holding only file A\u0027s mutex:\\n\\n  list_add corruption. prev-\u003enext should be next (ffff888101320f30),\\n    but was ffff88814a08c418. (prev=ffff88814a075c18).\\n  kernel BUG at lib/list_debug.c:32!\\n  Call Trace:\\n   ucma_write_cm_event+0x36e/0x5e0\\n\\nand file A\u0027s mut is left held forever, wedging its next writer in D state.\\nThe uevent is also stranded on a list ucma_cleanup_ctx_events() will not\\nwalk, so it outlives its context.  /dev/infiniband/rdma_cm is 0666 and no\\nRDMA device is involved, so an unprivileged user reaches all of this.\\n\\nTake the handler lock, as ucma_cleanup_mc_events() does; ctx-\u003ecm_id is\\npinned by the ucma_get_ctx() reference.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/core/ucma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5\",\"lessThan\":\"4f8bb11dd2ff365e7cff1c9964ab4607292d364e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5\",\"lessThan\":\"0be1955040a2eceed0ecfc387fdc92305411d273\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5\",\"lessThan\":\"f4cc21c6a8e9d392871477f9fd98d68e5ad80272\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/core/ucma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0be1955040a2eceed0ecfc387fdc92305411d273\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4f8bb11dd2ff365e7cff1c9964ab4607292d364e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f4cc21c6a8e9d392871477f9fd98d68e5ad80272\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T10:28:26+00:00",
      "cve": "CVE-2026-89507",
      "id": "CVE-2026-89507",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/ucma: Lock the handler in ucma_write_cm_event()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89507.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:39Z",
      "cve": "CVE-2026-89507",
      "id": "CVE-2026-89507",
      "initial_release_date": "2026-09-12T16:27:17Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89507",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89507.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.