CVE-2026-89508

A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the ucmasetibpath function when handling events concurrently with ucmamigrateid. This can allow a local attacker with access to an RDMA device to trigger a use-after-free vulnerability, potentially leading to...

CVE-2026-89508

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

CVE-2026-89508

The Linux kernel RDMA/ucma subsystem contains a race condition in ucma_set_ib_path(), which calls ucma_event_handler() from the write path without acquiring the handler lock. A concurrent ucma_migrate_id() can reassign ctx->file between mutex operations, causing list_add_tail() to target a dif...

EUVD-2026-76414

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...