{
  "threat_severity" : "Moderate",
  "public_date" : "2026-09-11T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: RDMA/ucma: Lock the handler in ucma_set_ib_path()",
    "id" : "2532308",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2532308"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-367",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nRDMA/ucma: Lock the handler in ucma_set_ib_path()\nucma_set_ib_path() calls ucma_event_handler() straight from the write()\npath, without the handler lock that keeps ctx->file stable while a uevent\nis queued.  The handler re-reads ctx->file for every dereference:\nmutex_lock(&ctx->file->mut);/* file A */\nlist_add_tail(&uevent->list, &ctx->file->event_list);/* file B */\nmutex_unlock(&ctx->file->mut);/* file B */\nwake_up_interruptible(&ctx->file->poll_wait);/* file B */\nA concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION\ncaller sleeps in mutex_lock(), so the list_add_tail() lands on file B's\nevent_list while only file A's mutex is held, racing every other user of\nthat list:\nBUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0\nRead of size 8 at addr ffff888153c6a418 by task poc_corr/486\nCall Trace:\n__list_add_valid_or_report+0x1aa/0x1c0\nucma_event_handler+0x1be/0xc00\nucma_set_ib_path+0x45e/0x710\nucma_set_option+0x32e/0x590\nucma_write+0x1f9/0x330\nAllocated by task 505:\nucma_write_cm_event+0x1a1/0x660\nFreed by task 505:\nkfree+0x1da/0x4c0\nucma_get_event+0x5d5/0x7e0\nThe freed object is a ucma_event that another thread dequeued from file B's\nlist under file B's mutex.  File A's mut is left held on top of that,\nwedging its next writer in uninterruptible sleep.\nThis path needs a bound and address-resolved cm_id, so it requires an RDMA\ndevice to be present.\nTake the handler lock around the call.", "A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the `ucma_set_ib_path()` function when handling events concurrently with `ucma_migrate_id()`. This can allow a local attacker with access to an RDMA device to trigger a use-after-free vulnerability, potentially leading to system instability or a denial of service." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-89508\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89508\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89508.mbox" ],
  "name" : "CVE-2026-89508",
  "csaw" : false
}