Linux kernel RDMA/uverbs: REG_MR ioctl passes NULL udata, crashing mthca, irdma and siw

Impact

The commit that added the REG_MR ioctl method missed that three providers - mthca, irdma and siw - carry driver-specific UHW data with reg_mr and assume udata is never NULL. Registering a memory region through the ioctl path with no valid udata therefore dereferences NULL inside those drivers and panics the host. rdma-core's ibv_cmd_reg_mr_ex() never passes udata and those drivers do not use it, so this never fires in normal operation - it takes a userspace process deliberately issuing the raw ioctl. Relevant where the RDMA path is irdma (Intel E810 RoCE) or siw (software iWARP, common in test and mixed-fabric clusters) and tenant workloads hold the verbs devices; the outcome is a node panic that drops every co-tenant, not memory disclosure.

Who can reach it

Local user holding an open /dev/infiniband/uverbs* device on a node whose RDMA provider is mthca, irdma or siw, issuing a crafted REG_MR ioctl. Requires deliberate action - no stock library or application triggers it.

What to do

Update the host kernel to a stable release adding UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR (three stable commits linked) and reboot the node. Nodes whose fabric is mlx5/ConnectX are not affected by the NULL-udata crash described here. Until patched, restrict uverbs device access on irdma and siw nodes. No fixed release number is stated.

References

Related entries

• Linux kernel fnic: sleeping allocation under an IRQ-safe spinlock during FCoE VLAN discoveryCVE-2026-89514 · Linux kernel scsi/fnic (Cisco VIC FCoE VLAN discovery)Unscored
• Linux kernel SCSI core: uninitialized kernel heap bytes are DMA'd out as DMA pad on unaligned transfersCVE-2026-89515 · Linux kernel SCSI core (scsi_alloc_sgtables DMA padding)Unscored
• Linux kernel sched_ext: BUG_ON panic when a DSQ is destroyed before a deferred re-enqueue runsCVE-2026-89516 · Linux kernel sched_ext (process_deferred_reenq_users BUG_ON on a destroyed DSQ)Unscored
• Linux kernel sched_ext: core-scheduling pick state corrupted when dispatch drops the rq lockCVE-2026-89517 · Linux kernel sched_ext (rq->core_pick and the keep-previous-task decision under core scheduling)Unscored
• Linux kernel sched_ext: deadlock and NULL deref when dispatch kfuncs assume the local rqCVE-2026-89518 · Linux kernel sched_ext dispatch kfuncs (this_rq() vs the dispatched rq under core scheduling)Unscored
• Linux kernel sched/core: core-scheduling selection corrupted by lock-dropping picks and concurrent flipsCVE-2026-89520 · Linux kernel sched/core (core-scheduling selection vs a pick_task() that releases the rq lock)Unscored