CVE-2026-89506
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid udata can trigger a NULL udata crash in those drivers. This never happens in real systems since in rdma-core ibv_cmd_reg_mr_ex() does not accept a udata and those three drivers don't use it, however a malicious userspace could trigger it.
Affected versions
Linux kernel versions
6.17
and later are affected. Fixed in
6.18.50,
7.2.4,
7.3-rc1
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-89506?
CVE-2026-89506 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.17 onward and has been patched in 6.18.50, 7.2.4 and 7.3-rc1. CVE-2026-89506 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89506?
Yes. CVE-2026-89506 has been patched. Fixed versions include 6.18.50, 7.2.4 and 7.3-rc1. If you are running Linux kernel 6.17 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89506 actively exploited?
No. CVE-2026-89506 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.