CVE-2026-89508: Linux Kernel RDMA/ucma Use-After-Free

CVE-2026-89508 Overview

CVE-2026-89508 is a use-after-free vulnerability in the Linux kernel's RDMA userspace connection manager (RDMA/ucma) subsystem. The flaw resides in ucma_set_ib_path(), which calls ucma_event_handler() directly from the write() path without holding the handler lock that keeps ctx->file stable while a uevent is queued. A concurrent ucma_migrate_id() can reassign ctx->file while the SET_OPTION caller sleeps in mutex_lock(), producing a slab use-after-free on a freed ucma_event object. Local users with access to RDMA devices can trigger the race to corrupt kernel memory.

Critical Impact
A local attacker with access to an RDMA device can trigger a slab use-after-free in the kernel event list, leading to memory corruption, denial of service, or potential local privilege escalation.

Affected Products

Linux kernel builds shipping the RDMA/ucma driver (drivers/infiniband/core/ucma.c) prior to the fix commits
Distributions exposing /dev/infiniband/rdma_cm to unprivileged or containerized workloads
Systems with RDMA-capable hardware (InfiniBand, RoCE, iWARP) where a bound and address-resolved cm_id can be established

Discovery Timeline

2026-09-11 - CVE-2026-89508 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89508

Vulnerability Analysis

The vulnerability is a race condition and use-after-free [CWE-416] in the RDMA userspace connection manager. ucma_set_ib_path() invokes ucma_event_handler() synchronously from the write() syscall path without acquiring the per-context handler lock. The handler re-reads ctx->file for each dereference during list insertion and wakeup.

While the SET_OPTION caller sleeps in mutex_lock(&ctx->file->mut) on the original file (file A), a concurrent ucma_migrate_id() reassigns ctx->file to a different file (file B). The subsequent list_add_tail() then links a ucma_event onto file B's event_list while only file A's mutex is held. A second thread dequeuing events from file B under file B's mutex frees the event via ucma_get_event() and kfree(), and the racing list_add_tail() operates on freed memory.

KASAN reports the resulting slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0 called from ucma_event_handler through ucma_set_ib_path and ucma_set_option. File A's mutex is left held on top of the corruption, wedging its next writer in uninterruptible sleep.

Root Cause

The root cause is missing synchronization between ucma_set_ib_path() and ucma_migrate_id(). The handler assumes ctx->file is stable during event queuing, but the SET_OPTION path did not take the handler lock before calling into ucma_event_handler(). Migration therefore races with event delivery on the same context.

Attack Vector

Exploitation requires local access, low privileges, and a bound, address-resolved cm_id, which implies an RDMA device must be present. An attacker opens two rdma_cm file descriptors, binds a context, then races repeated RDMA_USER_CM_CMD_SET_OPTION calls carrying IB_PATH data against RDMA_USER_CM_CMD_MIGRATE_ID operations. When the timing aligns, the write path queues an event onto the migrated file's list while holding the wrong file's mutex, corrupting the doubly-linked list and freeing memory that remains referenced.

Because realCodeExamples are not provided, refer to the upstream commits linked under Patch Information for the exact locking change.

Detection Methods for CVE-2026-89508

Indicators of Compromise

KASAN or KFENCE reports referencing slab-use-after-free in __list_add_valid_or_report with call stacks including ucma_event_handler, ucma_set_ib_path, ucma_set_option, or ucma_write
Kernel oops or general protection faults originating in drivers/infiniband/core/ucma.c
Processes stuck in uninterruptible sleep (D state) waiting on ucma_file mutexes after RDMA activity
Unexpected process termination or panics on hosts exposing /dev/infiniband/rdma_cm to non-root workloads

Detection Strategies

Enable KASAN on test and pre-production kernels to surface the exact use-after-free path during fuzzing of the rdma_cm character device
Audit workloads that open /dev/infiniband/rdma_cm and issue concurrent SET_OPTION (with IB_PATH) and MIGRATE_ID commands
Monitor kernel ring buffer (dmesg) and journalctl -k for list corruption warnings such as list_add corruption or __list_add_valid_or_report

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on stack traces containing ucma_ symbols
Track container and namespace access to InfiniBand device nodes using auditd rules on /dev/infiniband/*
Baseline RDMA syscall patterns per workload and flag processes that repeatedly invoke migrate and set-option ioctls in tight loops

How to Mitigate CVE-2026-89508

Immediate Actions Required

Apply the upstream Linux kernel fix that takes the handler lock around the ucma_event_handler() call in ucma_set_ib_path()
Rebuild and redeploy custom kernels using one of the stable backport commits referenced by the maintainers
Restrict access to /dev/infiniband/rdma_cm so that only trusted users and workloads that require RDMA can open the device
On hosts without RDMA hardware, unload or blacklist the rdma_ucm module to eliminate the attack surface

Patch Information

The fix acquires the per-context handler lock around the ucma_event_handler() invocation in ucma_set_ib_path(), preventing ucma_migrate_id() from reassigning ctx->file mid-flight. Stable backports are available in the following commits: Kernel Git Commit 28ac2dd, Kernel Git Commit 3dd07b3, Kernel Git Commit 43a7d8a, Kernel Git Commit 71dc206, Kernel Git Commit 764586f, Kernel Git Commit a7f8d26, Kernel Git Commit b2da0d48, and Kernel Git Commit ecbe7d36.

Workarounds

Remove or restrict permissions on /dev/infiniband/rdma_cm to prevent unprivileged access to the vulnerable ioctl surface
Blacklist the rdma_ucm and ib_ucm modules on systems that do not require userspace RDMA connection management
Deny the CAP_NET_ADMIN and RDMA device access to untrusted containers via seccomp, SELinux, or AppArmor policies

bash

# Configuration example
# Prevent the vulnerable module from loading on hosts that do not require userspace RDMA CM
echo 'blacklist rdma_ucm' | sudo tee /etc/modprobe.d/disable-rdma_ucm.conf
echo 'install rdma_ucm /bin/true' | sudo tee -a /etc/modprobe.d/disable-rdma_ucm.conf

# Remove currently loaded module (if not in use)
sudo modprobe -r rdma_ucm

# Restrict device node access to a trusted group
sudo chgrp rdma /dev/infiniband/rdma_cm
sudo chmod 0660 /dev/infiniband/rdma_cm