CVE-2026-89510 RDMA/cxgb4: Cancel reg_work before freeing device on remove

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89509

CVE-2026-89509 affects the Linux kernel 's RDMA/ionic driver . The root cause is that the ionic driver was merged without adapting to the rdma_zalloc_drv_obj() API introduced by commit 7e53b31acc7f, which requires drivers to embed struct rdma_counter in a driver-specific struct and register its s...

EUVD-2026-76415

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

EUVD-2026-76416

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89509 RDMA/ionic: Embed counter driver data in rdma_counter allocation

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89510 RDMA/cxgb4: Cancel reg_work before freeing device on remove

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89509 RDMA/ionic: Embed counter driver data in rdma_counter allocation

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89510

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89509

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89508

A race condition in the Linux kernel's RDMA/ucma component allows a local attacker with an RDMA device to trigger a use-after-free . The function ucma_set_ib_path() calls ucma_event_handler() without holding the handler lock; a concurrent ucma_migrate_id() can reassign ctx->file mid-operation,...

CVE-2026-89507

A race condition in the Linux kernel's RDMA/ucma subsystem affects the ucma_write_cm_event() function, which re-reads the ctx->file pointer four times without holding the handler lock. This allows ucma_migrate_id() to swap the pointer mid-sequence, leading to list corruption , a kernel BUG (cr...

CVE-2026-89508

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

EUVD-2026-76413

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

CVE-2026-89507 RDMA/ucma: Lock the handler in ucma_write_cm_event()

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

EUVD-2026-76414

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

CVE-2026-89508 RDMA/ucma: Lock the handler in ucma_set_ib_path()

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

CVE-2026-89508 RDMA/ucma: Lock the handler in ucma_set_ib_path()

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

CVE-2026-89507 RDMA/ucma: Lock the handler in ucma_write_cm_event()

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

CVE-2026-89507

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

CVE-2026-89506

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBSATTRUHW to UVERBSMETHODREGMR The original commit missed that three drivers mthca, irdma, siw have UHW data associated with regmr that cannot be passed through the ioctl. They also assume that the udata cann...