CVE-2026-89506: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
In the Linux kernel, the following vulnerability has been resolved:
RDMA/uverbs: Add UVERBSATTRUHW to UVERBSMETHODREGMR
The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with regmr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid udata can trigger a NULL udata crash in those drivers.
This never happens in real systems since in rdma-core ibvcmdregmrex() does not accept a udata and those three drivers don't use it, however a malicious userspace could trigger it.
Affected Software
Event History
Frequently Asked Questions
Who can realistically trigger this issue?
A malicious userspace process capable of issuing the relevant RDMA uverbs registration request can trigger it. The affected driver paths are mthca, irdma, and siw.
Are normal RDMA applications expected to encounter the crash?
No. The issue is not expected to occur in real systems through rdma-core's ibv_cmd_reg_mr_ex(), because that interface does not accept udata and the three affected drivers do not use it.
What is the failure mode if it is exploited?
The affected drivers assume udata is non-NULL. Supplying a registration request without valid udata can cause a NULL udata crash.