Linux kernel RDMA/ucma: use-after-free on the event list when SET_OPTION races context migration

Impact

ucma_set_ib_path() invokes ucma_event_handler() directly from the write() path without the handler lock that keeps ctx->file stable. A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION caller sleeps in mutex_lock(), so the event is added to file B's event_list while only file A's mutex is held. The reported outcome is a KASAN slab-use-after-free on an event another thread already dequeued and freed, plus file A's mutex left held, wedging its next writer in uninterruptible sleep. Unlike CVE-2026-89507 this path needs a bound, address-resolved cm_id, so an RDMA device must be present - on an InfiniBand or RoCE GPU fabric node that is the normal case. A use-after-free in a path any local user can drive is a node-integrity problem, not just a crash.

Who can reach it

Local unprivileged user on a node that has an RDMA device, via the world-writable /dev/infiniband/rdma_cm. No capabilities required; the caller must be able to bind and resolve a cm_id, which an ordinary user can do.

What to do

Apply the stable kernel update that takes the handler lock around the call (four stable commits linked) and reboot each node. No fixed version numbers are given in the record. Restricting /dev/infiniband/rdma_cm access for workloads that do not need rdma_cm removes the exposure without a reboot.

References

Related entries

• Linux kernel RDMA/ionic: NULL dereference allocating an RDMA counter on AMD Pensando DPUsCVE-2026-89509 · Linux kernel RDMA/ionic (rdma_counter allocation, missing INIT_RDMA_OBJ_SIZE)Unscored
• Linux kernel RDMA/cxgb4: use-after-free if device removal races the deferred RDMA registration workCVE-2026-89510 · Linux kernel RDMA/cxgb4 (c4iw_remove vs pending reg_work)Unscored
• Linux kernel ACPI Platform Firmware Runtime Update: firmware-supplied length overflows a stack bufferCVE-2026-89587 · Linux kernel ACPI pfr_update (query_capability _DSM buffer copy)Unscored
• Linux kernel APEI GHES: wrong sizeof lets ARM error-record parsing read past the CPER sectionCVE-2026-89588 · Linux kernel ACPI APEI GHES (ARM processor CPER section length accounting)Unscored
• Linux kernel RDMA/counter: failed QP bind leaks the port counter count and wedges counter modeCVE-2026-97477 · Linux kernel RDMA/counter (num_counters leak in alloc_and_bind() error path)Unscored
• Linux kernel hfi1: PIO credit-return mmap installs a bad pfn and oopses the nodeCVE-2026-98216 · Linux kernel IB/hfi1 (PIO_CRED credit-return mmap)Unscored