Junglewise Threat Intelligence

CVE-2026-89505: Linux kernel RDMA/uverbs null pointer dereference in legacy write path

CVE-2026-89505 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's RDMA (Remote Direct Memory Access) subsystem contains a null pointer dereference vulnerability in the legacy write() path used by InfiniBand user-space drivers. When malformed user input is processed, the kernel may dereference an uninitialized pointer, potentially causing a kernel crash or denial of service affecting systems using RDMA-capable network adapters.

Technical details

The vulnerability exists in the RDMA user verbs (uverbs) legacy write() dispatcher. The uverbs_attr_bundle structure passed to provider code does not initialize the method_elm (method element) pointer for legacy write paths, only for ioctl paths. When malformed user input triggers validation error handling in uverbs_get_handler_fn(), the function dereferences the uninitialized method_elm pointer without checking if it is NULL. The fix initializes method_elm to NULL for legacy write bundles and adds a NULL check in uverbs_get_handler_fn() to return NULL when no ioctl method is present, preventing the dereference. This is a local privilege escalation or denial-of-service vector requiring the ability to make RDMA system calls.

Affected products

  • Linux Linux kernel multiple versions (affecting RDMA subsystem)

Timeline

  • 2026-09-11: disclosed: CVE-2026-89505 published
  • 2026-08-18: patched: Fix committed upstream by Jason Gunthorpe
  • 2026-09-07: patched: Fix included in stable tree releases by Greg Kroah-Hartman

References

Related threats