Executive brief
The Linux kernel's RDMA (Remote Direct Memory Access) subsystem contains a vulnerability in memory region registration that can be triggered by malicious user-space code. A missing parameter allows three InfiniBand drivers to receive NULL data they expect to be valid, causing a crash that could lead to a denial of service or system instability.
Technical details
A missing UVERBS_ATTR_UHW attribute in the UVERBS_METHOD_REG_MR ioctl declaration causes three InfiniBand drivers (mthca, irdma, siw) to receive NULL user-data when performing memory region registration, while these drivers assume the udata parameter is always valid. The vulnerability exists because the original ioctl method definition lacked support for hardware-specific data (UHW) that these drivers require. A malicious user-space application can trigger this by invoking the reg_mr ioctl without the expected UHW data, causing a NULL pointer dereference and kernel crash. The fix adds the UVERBS_ATTR_UHW attribute to the method definition and passes the driver_udata from the ioctl attributes instead of NULL. This issue is low-risk in practice since legitimate rdma-core does not use this code path, but it represents an exploitable local denial-of-service vector.
Affected products
- Linux Linux Kernel Multiple versions prior to fix (linux 5.x, 6.x series)
Timeline
- 2026-09-11: disclosed: CVE-2026-89506 published
- 2026-07-02: patched: Fix committed upstream (commit 011199f46f44a9fd93a9e5ab5d7fd1328d80e9bf)
- 2026-09-07: patched: Fix backported to stable kernels (commit 71d5c41ac583df09a7c32199bef7d42de7267d07)