CVE-2026-89507

A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the ucma_write_cm_event() function where it re-reads a critical file pointer multiple times without proper locking. This allows another function, ucma_migrate_id(), to change the file pointer mid-operation. An unprivileged local user can exploit this to cause list corruption, trigger a kernel crash, and leave a mutex locked indefinitely, resulting in a denial of service.

Important severity is assigned to this flaw because an unprivileged local user can exploit this synchronization issue to corrupt kernel memory and induce an unrecoverable system crash without requiring dedicated RDMA hardware. In standard deployments, the associated connection manager device node exposes broad local permissions by default. Red Hat Enterprise Linux is not affected as the vulnerable code introduced in upstream kernel branches was not included in supported product kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.