UBUNTU-CVE-2026-89506: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBSATTRUHW to UVERBSMETHODREGMR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with regmr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid udata can trigger a NULL udata crash in those drivers. This never happens in real systems since in rdma-core ibvcmdregmrex() does not accept a udata and those three drivers don't use it, however a malicious userspace could trigger it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the affected Ubuntu Linux kernel packages are potentially exposed, but exploitation requires malicious userspace interaction with RDMA uverbs registration. The issue concerns the mthca, irdma, and siw RDMA drivers.
What does an attacker need to exploit it?
An attacker needs the ability to run malicious userspace code that invokes the relevant RDMA uverbs memory-registration path. The normal rdma-core ibv_cmd_reg_mr_ex() path does not supply the triggering data, so this condition does not occur in ordinary real-world use.
What is the likely impact of exploitation?
The affected drivers can dereference a NULL udata pointer, causing a crash. The provided information describes a denial-of-service condition rather than data disclosure or privilege escalation.
How can I tell whether my system may be affected?
Review whether the system runs one of the listed Ubuntu kernel packages and uses an mthca, irdma, or siw RDMA driver. The vulnerability is relevant to the RDMA uverbs memory-registration interface rather than standard rdma-core registration behavior.