CVE-2026-89505: Linux Kernel RDMA/uverbs Use-After-Free

CVE-2026-89505 Overview

CVE-2026-89505 is a null pointer dereference vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) user-verbs subsystem. The flaw resides in the legacy write() dispatch path of uverbs, where the uverbs_attr_bundle passed to provider code lacks an ioctl method_elm element. When malformed provider input triggers the common uverbs validation code to emit an error message, uverbs_get_handler_fn() dereferences the uninitialized method_elm pointer. This condition can lead to a kernel crash and denial of service on affected systems using RDMA verbs interfaces.

Critical Impact
Local users with access to RDMA /dev/infiniband/uverbs* character devices can trigger a kernel null pointer dereference by supplying malformed input, resulting in a denial-of-service condition.

Affected Products

Linux kernel versions containing the vulnerable RDMA/uverbs legacy write path
Systems with InfiniBand/RDMA subsystem enabled (CONFIG_INFINIBAND_USER_ACCESS)
Distributions shipping kernels prior to the fix commit 60a42d510113

Discovery Timeline

2026-09-11 - CVE-2026-89505 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89505

Vulnerability Analysis

The Linux kernel exposes RDMA functionality to userspace through two interfaces: the legacy write() system call path and the newer ioctl() path. Both paths converge on shared validation code that operates on a uverbs_attr_bundle structure. This structure is expected to carry an ioctl method_elm element used by helper routines when reporting errors.

The legacy dispatcher constructs a uverbs_attr_bundle from a uverbs_api_write_method but does not populate the method_elm field. When malformed provider input passes through the common validation layer, the error-reporting path invokes uverbs_get_handler_fn(), which dereferences the uninitialized pointer. The result is a kernel-mode null pointer dereference categorized under [CWE-476].

Root Cause

The root cause is an inconsistent initialization contract between two code paths sharing the same helper. The ioctl path guarantees method_elm is populated, while the legacy write path leaves it uninitialized. The shared validation code assumes the field is always valid before dereferencing it during error emission.

Attack Vector

Exploitation requires local access to the RDMA character devices and permission to open a uverbs file descriptor. An attacker crafts a legacy write() request containing malformed provider attributes that fail common validation. When the kernel attempts to emit a diagnostic message, the null dereference occurs in kernel context, panicking the host or terminating the affected task depending on kernel configuration.

No verified proof-of-concept code is publicly available. The fix commits 60a42d510113 and edae84e54617 provide the authoritative technical detail. See the Linux Kernel Commit - Security Fix and the Linux Kernel Commit - Improvement.

Detection Methods for CVE-2026-89505

Indicators of Compromise

Kernel oops or panic messages referencing uverbs_get_handler_fn or ib_uverbs_write in dmesg output.
Unexpected process terminations for workloads holding open file descriptors on /dev/infiniband/uverbs* nodes.
Repeated EINVAL or malformed-attribute error entries logged from the InfiniBand core module.

Detection Strategies

Monitor kernel ring buffers for null pointer dereference stack traces originating in the ib_uverbs module.
Audit which local users and containers have read/write access to /dev/infiniband/uverbs* character devices.
Correlate host crashes with preceding syscall activity from unprivileged processes targeting RDMA devices.

Monitoring Recommendations

Ingest dmesg, journalctl -k, and kdump artifacts into a centralized log store for pattern matching on kernel fault signatures.
Track kernel version inventory across Linux fleets to identify hosts still running unpatched builds.
Alert on new processes opening uverbs devices outside of expected RDMA workloads such as MPI, NVMe-oF, or NFS-RDMA services.

How to Mitigate CVE-2026-89505

Immediate Actions Required

Apply the upstream kernel fix from commit 60a42d510113f46de47e86a84bf5758597644487 and the follow-up hardening in edae84e5461749ed9adf9fcf5c6e075381040ac3.
Update to a distribution kernel that incorporates both commits and reboot affected hosts.
Restrict access to /dev/infiniband/uverbs* devices to trusted service accounts and RDMA workloads only.

Patch Information

The fix initializes method_elm explicitly for legacy bundles and updates uverbs_get_handler_fn() to return NULL when no ioctl method is present. The legacy dispatcher continues using its local write method, while the ioctl path continues using the registered ioctl handler. Apply the patches from the Linux Kernel Commit - Security Fix and the Linux Kernel Commit - Improvement.

Workarounds

Unload the ib_uverbs module on hosts that do not require userspace RDMA: modprobe -r ib_uverbs.
Tighten permissions on /dev/infiniband/uverbs* using udev rules to limit access to the rdma group or a dedicated service account.
Disable CONFIG_INFINIBAND_USER_ACCESS at kernel build time for systems that do not need userspace RDMA support.

bash

# Configuration example
# Restrict uverbs device access via udev
cat >/etc/udev/rules.d/90-rdma-restrict.rules <<'EOF'
KERNEL=="uverbs*", SUBSYSTEM=="infiniband_verbs", GROUP="rdma", MODE="0660"
EOF
udevadm control --reload-rules && udevadm trigger

# Optional: blocklist the module on hosts that do not require userspace RDMA
echo 'blacklist ib_uverbs' >/etc/modprobe.d/blacklist-ib_uverbs.conf