Linux kernel RDMA/uverbs: legacy write() bundle has no ioctl method element, causing a NULL dereference

Impact

The legacy uverbs write() path dispatches through a uverbs_api_write_method, but the uverbs_attr_bundle handed to provider code carries no ioctl method element. If malformed provider input makes the common uverbs validation code emit an error message, uverbs_get_handler_fn() dereferences the uninitialized method_elm pointer. On a GPU fleet the verbs character devices are what RDMA workloads - NCCL over RoCE or InfiniBand, GPUDirect RDMA, parallel filesystem clients - hold open, and on many clusters that means tenant containers have them mapped. A tenant that submits deliberately malformed verbs input crashes the host kernel, taking down every other tenant on a node that cannot be drained cheaply.

Who can reach it

Local user holding an open /dev/infiniband/uverbs* device, which in practice means any tenant pod granted RDMA access. Authenticated in the sense that device access is required; no network path.

What to do

Update the host kernel to a stable release that initializes method_elm for legacy bundles and returns NULL when no ioctl method is present (two stable commits linked), then reboot each node. Interim mitigation is to stop exposing the uverbs devices to untrusted workloads, which for most RDMA tenants removes the capability they came for. No fixed release number is given.

References

Related entries

• Linux kernel RDMA/uverbs: REG_MR ioctl passes NULL udata, crashing mthca, irdma and siwCVE-2026-89506 · Linux kernel RDMA/uverbs UVERBS_METHOD_REG_MR (missing UHW attribute; mthca, irdma, siw)Unscored
• Linux kernel fnic: sleeping allocation under an IRQ-safe spinlock during FCoE VLAN discoveryCVE-2026-89514 · Linux kernel scsi/fnic (Cisco VIC FCoE VLAN discovery)Unscored
• Linux kernel SCSI core: uninitialized kernel heap bytes are DMA'd out as DMA pad on unaligned transfersCVE-2026-89515 · Linux kernel SCSI core (scsi_alloc_sgtables DMA padding)Unscored
• Linux kernel sched_ext: BUG_ON panic when a DSQ is destroyed before a deferred re-enqueue runsCVE-2026-89516 · Linux kernel sched_ext (process_deferred_reenq_users BUG_ON on a destroyed DSQ)Unscored
• Linux kernel sched_ext: core-scheduling pick state corrupted when dispatch drops the rq lockCVE-2026-89517 · Linux kernel sched_ext (rq->core_pick and the keep-previous-task decision under core scheduling)Unscored
• Linux kernel sched_ext: deadlock and NULL deref when dispatch kfuncs assume the local rqCVE-2026-89518 · Linux kernel sched_ext dispatch kfuncs (this_rq() vs the dispatched rq under core scheduling)Unscored