CVE-2026-89505: RDMA/uverbs: Guard legacy bundles without method_elm
In the Linux kernel, the following vulnerability has been resolved:
RDMA/uverbs: Guard legacy bundles without methodelm
The legacy write() path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider input causes the common uverbs validation code to emit an error message, uverbsgethandlerfn() dereferences the uninitialized methodelm pointer.
Initialize methodelm explicitly for legacy bundles and make uverbsgethandlerfn() return NULL when no ioctl method is present. The legacy dispatcher continues to use its local write method, while the ioctl path continues to use the registered ioctl handler.
Affected Software
Event History
Frequently Asked Questions
Which interface reaches the vulnerable code path?
The issue is in the legacy RDMA/uverbs write() dispatch path. The ioctl path uses its registered ioctl handler and is not described as dereferencing the missing ioctl method element.
What is required to trigger the fault?
Malformed provider input must cause the common uverbs validation code to emit an error message while processing a legacy write() bundle. In that situation, handler lookup can dereference an uninitialized method_elm pointer.
What behavior changes with the fix?
Legacy bundles explicitly initialize method_elm, and handler lookup returns NULL when no ioctl method is present. Legacy dispatch still uses its local write method, while ioctl dispatch continues using the registered ioctl handler.