CVE-2026-89507: Linux Kernel RDMA/ucma Race Condition Vulnerability

CVE-2026-89507 Overview

CVE-2026-89507 is a race condition in the Linux kernel's RDMA userspace connection manager (ucma) subsystem. The flaw resides in ucma_write_cm_event(), which re-reads ctx->file across four dereferences without holding the handler lock. A concurrent ucma_migrate_id() call can swap ctx->file mid-sequence, causing list corruption and a kernel BUG at lib/list_debug.c:32. Because /dev/infiniband/rdma_cm is world-accessible with mode 0666 and no RDMA hardware is required, an unprivileged local user can trigger the condition. The fix acquires the handler lock in the write path, matching the pattern already used by ucma_cleanup_mc_events().

Critical Impact
An unprivileged local user can corrupt kernel linked lists, wedge processes in uninterruptible sleep, and potentially escalate to arbitrary kernel memory corruption.

Affected Products

Linux kernel (RDMA/ucma subsystem)
Distributions shipping affected stable kernel branches referenced by the upstream fix commits
Systems exposing /dev/infiniband/rdma_cm to unprivileged users

Discovery Timeline

2026-09-11 - CVE-2026-89507 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89507

Vulnerability Analysis

The defect is a Time-of-Check Time-of-Use (TOCTOU) race in the RDMA userspace Communication Manager Access (ucma) module. The function ucma_write_cm_event() dereferences ctx->file four separate times to lock a mutex, append to an event list, unlock the mutex, and wake pollers. The rule enforced elsewhere in the subsystem requires that ctx->file only change while both the handler lock and the xa_lock are held.

Write paths that queue user events did not honor this invariant. ucma_migrate_id() can reassign ctx->file from file A to file B while a concurrent writer sleeps inside mutex_lock(&ctx->file->mut). The writer wakes holding file A's mutex, then calls list_add_tail() on file B's event_list. The kernel's list debugging catches the inconsistency and panics.

Root Cause

The root cause is missing synchronization between the ucma write path and context migration. ctx->file is a mutable pointer protected by the handler lock, but ucma_write_cm_event() reads it without acquiring that lock. The re-reads make the function non-atomic with respect to ucma_migrate_id().

Attack Vector

Exploitation requires local access and the ability to open /dev/infiniband/rdma_cm, which is exposed to all users by default on affected systems. An attacker races write() calls issued to two ucma file descriptors while migrating a context between them. The resulting linked-list corruption can crash the kernel, leave file A's mutex held indefinitely (wedging subsequent writers in D state), and orphan uevents that ucma_cleanup_ctx_events() will not free. Linked-list corruption in kernel memory has historically been leveraged for privilege escalation when the freed or misplaced object can be reclaimed by attacker-controlled data.

No verified public exploit code is available. See the upstream fix commits 0be1955, 4f8bb11, and f4cc21c for the code-level change.

Detection Methods for CVE-2026-89507

Indicators of Compromise

Kernel panic messages referencing list_add corruption with ucma_write_cm_event+0x36e/0x5e0 in the call trace
Processes stuck in uninterruptible sleep (D state) after interacting with /dev/infiniband/rdma_cm
Unexpected kernel BUG at lib/list_debug.c:32 entries in dmesg or journalctl -k

Detection Strategies

Monitor kernel logs for list-debug BUGs and stack traces containing ucma_ symbols
Audit which unprivileged processes open /dev/infiniband/rdma_cm on hosts that do not host RDMA workloads
Alert on concurrent write() and RDMA_USER_CM_CMD_MIGRATE_ID operations from the same UID

Monitoring Recommendations

Collect dmesg and /var/log/kern.log into a centralized log pipeline and alert on list_add corruption strings
Track running kernel versions across the fleet and flag hosts on branches predating commits 0be1955, 4f8bb11, and f4cc21c
Use auditd rules on /dev/infiniband/rdma_cm opens to build a baseline of legitimate users

How to Mitigate CVE-2026-89507

Immediate Actions Required

Apply the upstream kernel patches or the distribution's backport as soon as they are available
Restrict access to /dev/infiniband/rdma_cm on hosts that do not require RDMA client functionality
Blacklist the rdma_ucm kernel module on systems that never use userspace RDMA connection management

Patch Information

The fix takes the handler lock inside ucma_write_cm_event() before touching ctx->file, mirroring the locking already performed by ucma_cleanup_mc_events(). The ctx->cm_id pointer remains pinned by the existing ucma_get_ctx() reference. Upstream commits: 0be1955, 4f8bb11, and f4cc21c.

Workarounds

Unload the module with modprobe -r rdma_ucm on hosts that do not need userspace RDMA CM
Tighten permissions on /dev/infiniband/rdma_cm from 0666 to 0660 and restrict group membership
Add a modprobe.d blacklist entry to prevent the module from loading on reboot

bash

# Restrict access to the ucma device and prevent module load
echo 'blacklist rdma_ucm' | sudo tee /etc/modprobe.d/blacklist-rdma-ucm.conf
sudo modprobe -r rdma_ucm
sudo chmod 0660 /dev/infiniband/rdma_cm 2>/dev/null || true
sudo chgrp rdma /dev/infiniband/rdma_cm 2>/dev/null || true