Executive brief
The Linux kernel's RDMA (Remote Direct Memory Access) user-space communication module contains a race condition in the ucma_set_ib_path() function that can lead to use-after-free memory access. An attacker with local access to the system can trigger concurrent operations that cause data structure corruption and kernel crashes, potentially leading to denial of service or privilege escalation.
Technical details
The vulnerability is a race condition (CWE-362) in the RDMA ucma subsystem where ucma_set_ib_path() invokes ucma_event_handler() without holding the necessary handler lock. Concurrent calls to ucma_migrate_id() can reassign ctx->file while the handler is queuing events, causing a list_add_tail() operation to reference an incorrect file descriptor's event list under the wrong mutex, leading to use-after-free (CWE-416). This results in corrupted kernel data structures and KASAN (Kernel Address Sanitizer) warnings. The attack requires local system access and a bound RDMA connection, with no known active exploitation. The fix involves acquiring the handler lock around the ucma_event_handler() call in ucma_set_ib_path().
Affected products
- Linux Linux kernel RDMA ucma subsystem (version range not specified in advisory)
Timeline
- 2026-09-11: disclosed