CVE-2026-89506: Linux Kernel RDMA Buffer Overflow Vulnerability

CVE-2026-89506 Overview

CVE-2026-89506 affects the Linux kernel's RDMA (Remote Direct Memory Access) userspace verbs subsystem. The vulnerability stems from a missing UVERBS_ATTR_UHW attribute on the UVERBS_METHOD_REG_MR ioctl method. Three RDMA drivers (mthca, irdma, and siw) rely on user handshake (UHW) data associated with memory region registration (reg_mr) that cannot be passed through the ioctl interface. These drivers assume udata is never NULL. A local, malicious userspace process can invoke the ioctl path against these drivers and trigger a NULL pointer dereference in the kernel. The issue does not occur through the standard rdma-core library because ibv_cmd_reg_mr_ex() does not exercise this path against the affected drivers.

Critical Impact
A local unprivileged user with access to an affected RDMA device can trigger a kernel NULL pointer dereference, resulting in a denial of service (kernel crash) on hosts using the mthca, irdma, or siw drivers.

Affected Products

Linux kernel RDMA/uverbs subsystem (UVERBS_METHOD_REG_MR ioctl path)
Systems using the mthca (Mellanox InfiniHost) driver
Systems using the irdma (Intel Ethernet RDMA) and siw (Software iWARP) drivers

Discovery Timeline

2026-09-11 - CVE-2026-89506 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89506

Vulnerability Analysis

The RDMA userspace verbs (uverbs) subsystem exposes two interfaces for memory region registration: a legacy write-based path and a newer ioctl-based path defined by UVERBS_METHOD_REG_MR. When the ioctl path was introduced, the UVERBS_ATTR_UHW attribute (which carries driver-specific user handshake data) was not wired into UVERBS_METHOD_REG_MR. The mthca, irdma, and siw drivers consume UHW data during reg_mr and dereference the udata pointer without a NULL check. When userspace calls the ioctl path against one of these drivers, udata arrives as NULL and the driver dereferences it, producing a kernel oops. The bug is scoped to local access on hosts that expose these drivers to unprivileged users through /dev/infiniband/uverbs*.

Root Cause

The root cause is an incomplete API definition. UVERBS_METHOD_REG_MR did not declare UVERBS_ATTR_UHW, so the ioctl framework never allocated or populated the udata structure passed to driver callbacks. Drivers assuming udata was always valid had no defensive NULL check, converting an API omission into a NULL pointer dereference.

Attack Vector

Exploitation requires local access to an RDMA character device such as /dev/infiniband/uverbs0 on a host running an affected driver. A crafted userspace program bypasses rdma-core and issues the UVERBS_METHOD_REG_MR ioctl directly, omitting UHW data. The affected driver dereferences the NULL udata pointer during memory region registration and the kernel crashes. The impact is limited to denial of service; the referenced commits do not describe memory disclosure or privilege escalation.

No public proof-of-concept code has been released. Readers can review the upstream fix in the Linux kernel commit 9e71d0f4944b and the backports at commit 011199f46f44 and commit 71d5c41ac583.

Detection Methods for CVE-2026-89506

Indicators of Compromise

Kernel oops or panic messages referencing ib_uverbs, mthca_reg_user_mr, irdma_reg_user_mr, or siw_reg_user_mr in dmesg or /var/log/kern.log.
Unexpected process terminations or hangs on hosts exposing /dev/infiniband/uverbs* to non-root users.
Repeated ioctl system calls targeting UVERBS_METHOD_REG_MR from unprivileged processes without a corresponding rdma-core library trace.

Detection Strategies

Audit which local users and containers have read/write access to /dev/infiniband/uverbs* and correlate against expected RDMA workloads.
Enable kernel crash reporting (kdump, systemd-coredump) and alert on any RIP within RDMA driver reg_mr handlers.
Use auditd rules to log ioctl calls against InfiniBand uverbs devices from processes outside an allow-list.

Monitoring Recommendations

Forward kern.log and dmesg output to a centralized log platform and alert on RDMA-related NULL pointer dereference stack traces.
Monitor for repeated crashes or reboots on RDMA-enabled hosts, particularly those using mthca, irdma, or siw.
Track the running kernel version across the fleet and flag hosts that have not received the fixes from the referenced stable commits.

How to Mitigate CVE-2026-89506

Immediate Actions Required

Inventory hosts loading the mthca, irdma, or siw kernel modules using lsmod | grep -E 'mthca|irdma|siw'.
Restrict access to /dev/infiniband/uverbs* so only trusted service accounts can open the device.
Apply the vendor-provided kernel update as soon as a patched build is available for your distribution.

Patch Information

The upstream fix adds UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR so the ioctl path allocates a valid udata structure before invoking driver callbacks. The fix is available in the mainline commit 9e71d0f4944b with stable backports at 011199f46f44 and 71d5c41ac583. Rebuild or update to a distribution kernel that includes these commits and reboot affected hosts.

Workarounds

Unload the siw module (modprobe -r siw) on hosts that do not require software iWARP.
On systems without production RDMA workloads, blacklist mthca, irdma, and siw in /etc/modprobe.d/ until patched.
Tighten permissions on RDMA devices, for example chmod 0660 /dev/infiniband/uverbs* combined with a dedicated group, to reduce the local attack surface.