Linux kernel RDMA/ucma: use-after-free on the event list when SET_OPTION races context migration

Impact

ucma_set_ib_path() invokes ucma_event_handler() directly from the write() path without the handler lock that keeps ctx->file stable. A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION caller sleeps in mutex_lock(), so the event is added to file B's event_list while only file A's mutex is held. The reported outcome is a KASAN slab-use-after-free on an event another thread already dequeued and freed, plus file A's mutex left held, wedging its next writer in uninterruptible sleep. Unlike CVE-2026-89507 this path needs a bound, address-resolved cm_id, so an RDMA device must be present - on an InfiniBand or RoCE GPU fabric node that is the normal case. A use-after-free in a path any local user can drive is a node-integrity problem, not just a crash.

Who can reach it

Local unprivileged user on a node that has an RDMA device, via the world-writable /dev/infiniband/rdma_cm. No capabilities required; the caller must be able to bind and resolve a cm_id, which an ordinary user can do.

What to do

Apply the stable kernel update that takes the handler lock around the call (four stable commits linked) and reboot each node. No fixed version numbers are given in the record. Restricting /dev/infiniband/rdma_cm access for workloads that do not need rdma_cm removes the exposure without a reboot.

References

Related entries

• Linux kernel RDMA/ionic: NULL dereference allocating an RDMA counter on AMD Pensando DPUsCVE-2026-89509 · Linux kernel RDMA/ionic (rdma_counter allocation, missing INIT_RDMA_OBJ_SIZE)Unscored
• Linux kernel RDMA/cxgb4: use-after-free if device removal races the deferred RDMA registration workCVE-2026-89510 · Linux kernel RDMA/cxgb4 (c4iw_remove vs pending reg_work)Unscored
• Linux kernel ACPI Platform Firmware Runtime Update: firmware-supplied length overflows a stack bufferCVE-2026-89587 · Linux kernel ACPI pfr_update (query_capability _DSM buffer copy)Unscored
• Linux kernel APEI GHES: wrong sizeof lets ARM error-record parsing read past the CPER sectionCVE-2026-89588 · Linux kernel ACPI APEI GHES (ARM processor CPER section length accounting)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored