CVE-2026-89508RDMA/ucma: Lock the handler in ucma_set_ib_path()
- 7.8HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path() ucma_set_ib_path() calls ucma_event_handler() straight from the write() path, without the handler lock that keeps ctx->file stable while a uevent is queued. The handler re-reads ctx->file for every dereference: mutex_lock(&ctx->file->mut); /* file A */ list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */ mutex_unlock(&ctx->file->mut); /* file B */ wake_up_interruptible(&ctx->file->poll_wait); /* file B */ A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION caller sleeps in mutex_lock(), so the list_add_tail() lands on file B's event_list while only file A's mutex is held, racing every other user of that list: BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0 Read of size 8 at addr ffff888153c6a418 by task poc_corr/486 Call Trace: __list_add_valid_or_report+0x1aa/0x1c0 ucma_event_handler+0x1be/0xc00 ucma_set_ib_path+0x45e/0x710 ucma_set_option+0x32e/0x590 ucma_write+0x1f9/0x330 Allocated by task 505: ucma_write_cm_event+0x1a1/0x660 Freed by task 505: kfree+0x1da/0x4c0 ucma_get_event+0x5d5/0x7e0 The freed object is a ucma_event that another thread dequeued from file B's list under file B's mutex. File A's mut is left held on top of that, wedging its next writer in uninterruptible sleep. This path needs a bound and address-resolved cm_id, so it requires an RDMA device to be present. Take the handler lock around the call.
Timeline
ID reserved
By Linux
Published
- 38 days later
· 38 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 98% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 09e328e47a695b0d346598f5d6593ee598e64885 – < 3dd07b369371a2f29e1c3caf1ade85bb92b4c551
- affected 09e328e47a695b0d346598f5d6593ee598e64885 – < b2da0d488a1c72956ebb0a57015ee8ee6a2f7748
- affected 09e328e47a695b0d346598f5d6593ee598e64885 – < a7f8d26e653ee43b0b572984b8ec544d3b3b6f3c
- affected 09e328e47a695b0d346598f5d6593ee598e64885 – < 71dc206f2e2a645dac78879768762451aa1799f7
- affected 09e328e47a695b0d346598f5d6593ee598e64885 – < 764586f8f6180084c5a7d622120f526acc6ce0c9
- affected 09e328e47a695b0d346598f5d6593ee598e64885 – < 28ac2dd416482d1c763c4af5d61af465b387fb50
- affected 09e328e47a695b0d346598f5d6593ee598e64885 – < 43a7d8ae9f645dc00235cfa4bf57673c20b769f8
- affected 09e328e47a695b0d346598f5d6593ee598e64885 – < ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820
- affected 5.10
- unaffected < 5.10
- unaffected 5.10.270 – ≤ 5.10.*
- unaffected 5.15.221 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/3dd07b369371a2f29e1c3caf1ade85bb92b4c551 (opens in a new tab)
- https://git.kernel.org/stable/c/b2da0d488a1c72956ebb0a57015ee8ee6a2f7748 (opens in a new tab)
- https://git.kernel.org/stable/c/a7f8d26e653ee43b0b572984b8ec544d3b3b6f3c (opens in a new tab)
- https://git.kernel.org/stable/c/71dc206f2e2a645dac78879768762451aa1799f7 (opens in a new tab)
- https://git.kernel.org/stable/c/764586f8f6180084c5a7d622120f526acc6ce0c9 (opens in a new tab)
- https://git.kernel.org/stable/c/28ac2dd416482d1c763c4af5d61af465b387fb50 (opens in a new tab)
- https://git.kernel.org/stable/c/43a7d8ae9f645dc00235cfa4bf57673c20b769f8 (opens in a new tab)
- https://git.kernel.org/stable/c/ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76414 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89508)Record last updated .