UBUNTU-CVE-2026-89509: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj()") requires drivers implementing counter ops to embed struct rdmacounter in a driver-specific struct, register its size via INITRDMAOBJSIZE, and provide a counterinit callback. The ionic driver was merged without this adaptation, causing a NULL pointer dereference in allocandbind() since rdmazallocdrvobj() allocates zero bytes when sizerdmacounter is unset. Consolidate struct ioniccounter into a new struct ionicrdmacounter that embeds struct rdmacounter, replace the xarray with a lightweight ida for ID allocation, and add the required counterinit and INITRDMAOBJSIZE declarations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Adapt the ionic RDMA counter driver to embed struct rdma_counter in a new struct ionic_rdma_counter, replace the xarray with a lightweight ida for ID allocation, register the driver object size with INIT_RDMA_OBJ_SIZE, and provide the required counter_init callback.
Event History
Frequently Asked Questions
Which systems are most relevant to triage?
Systems using the RDMA/ionic driver are the relevant population. The issue is present in the listed Ubuntu kernel packages, including linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What condition triggers the failure?
The failure occurs in alloc_and_bind() when the driver allocates an RDMA counter without having registered the required rdma_counter object size. In that state, rdma_zalloc_drv_obj() allocates zero bytes and a NULL pointer dereference results.
What does the resolved implementation change?
The fix embeds struct rdma_counter in a driver-specific ionic_rdma_counter structure, adds counter initialization support, and registers the required object size. It also replaces the prior xarray-based counter tracking with an ID allocator.