Executive brief
The Linux kernel's RDMA (Remote Direct Memory Access) subsystem contains a null pointer dereference vulnerability in the legacy write() path used by InfiniBand user-space drivers. When malformed user input is processed, the kernel may dereference an uninitialized pointer, potentially causing a kernel crash or denial of service affecting systems using RDMA-capable network adapters.
Technical details
The vulnerability exists in the RDMA user verbs (uverbs) legacy write() dispatcher. The uverbs_attr_bundle structure passed to provider code does not initialize the method_elm (method element) pointer for legacy write paths, only for ioctl paths. When malformed user input triggers validation error handling in uverbs_get_handler_fn(), the function dereferences the uninitialized method_elm pointer without checking if it is NULL. The fix initializes method_elm to NULL for legacy write bundles and adds a NULL check in uverbs_get_handler_fn() to return NULL when no ioctl method is present, preventing the dereference. This is a local privilege escalation or denial-of-service vector requiring the ability to make RDMA system calls.
Affected products
- Linux Linux kernel multiple versions (affecting RDMA subsystem)
Timeline
- 2026-09-11: disclosed: CVE-2026-89505 published
- 2026-08-18: patched: Fix committed upstream by Jason Gunthorpe
- 2026-09-07: patched: Fix included in stable tree releases by Greg Kroah-Hartman