Linux kernel RDMA/ucma: unprivileged event-list corruption when a context is migrated mid-write

Impact

ucma_write_cm_event() queues a uevent without holding the handler lock and re-reads ctx->file for each dereference, so a concurrent ucma_migrate_id() can swap the file between the mutex_lock() and the list_add_tail(). The result in the report is list corruption and a kernel BUG, file A's mutex left held forever (its next writer is stuck in D state), and a uevent stranded on a list the cleanup path never walks, so it outlives its context. What makes this one worth attention is reach: /dev/infiniband/rdma_cm is mode 0666 and no RDMA device has to be present, so any local unprivileged user - including a tenant in a container where /dev/infiniband is exposed - can trigger it. On a GPU node the cost is a panic or a permanently wedged writer, and clearing it means a reboot of a node that is expensive to drain.

Who can reach it

Any local unprivileged user who can open /dev/infiniband/rdma_cm, which is world-writable by default. No RDMA hardware, no capabilities and no authentication beyond a shell on the node (or a pod with that device node exposed).

What to do

Take the stable kernel update carrying the fix (the three stable commits are linked) and reboot each node; there is no live mitigation in the record short of blocking access to /dev/infiniband/rdma_cm for untrusted users, which is a reasonable interim step on nodes where tenants do not use rdma_cm. The record names no fixed release numbers, only the commits.

References

Related entries

• Linux kernel RDMA/ucma: use-after-free on the event list when SET_OPTION races context migrationCVE-2026-89508 · Linux kernel RDMA/ucma (ucma_set_ib_path / SET_OPTION path)Unscored
• Linux kernel RDMA/ionic: NULL dereference allocating an RDMA counter on AMD Pensando DPUsCVE-2026-89509 · Linux kernel RDMA/ionic (rdma_counter allocation, missing INIT_RDMA_OBJ_SIZE)Unscored
• Linux kernel RDMA/cxgb4: use-after-free if device removal races the deferred RDMA registration workCVE-2026-89510 · Linux kernel RDMA/cxgb4 (c4iw_remove vs pending reg_work)Unscored
• Linux kernel ACPI Platform Firmware Runtime Update: firmware-supplied length overflows a stack bufferCVE-2026-89587 · Linux kernel ACPI pfr_update (query_capability _DSM buffer copy)Unscored
• Linux kernel APEI GHES: wrong sizeof lets ARM error-record parsing read past the CPER sectionCVE-2026-89588 · Linux kernel ACPI APEI GHES (ARM processor CPER section length accounting)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored