Linux Kernel up to 7.2.3 RDMA/uverbs uverbs_get_handler_fn uninitialized variable

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.2.3 and classified as very critical. Affected by this issue is the function uverbs_get_handler_fn of the component RDMA/uverbs. Performing a manipulation results in uninitialized variable. This vulnerability is cataloged as CVE-2026-89505. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.3. It has been classified as very critical. This affects the function uverbs_get_handler_fn of the component RDMA/uverbs. The manipulation with an unknown input leads to a uninitialized variable vulnerability. CWE is classifying the issue as CWE-457. The code uses a variable that has not been initialized, leading to unpredictable or unintended results. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without method_elm The legacy write() path dispatches through a uverbs_api_write_method, but the uverbs_attr_bundle passed to provider code does not have an ioctl method element. If malformed provider input causes the common uverbs validation code to emit an error message, uverbs_get_handler_fn() dereferences the uninitialized method_elm pointer. Initialize method_elm explicitly for legacy bundles and make uverbs_get_handler_fn() return NULL when no ioctl method is present. The legacy dispatcher continues to use its local write method, while the ioctl path continues to use the registered ioctl handler.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-89505 since 09/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/12/2026).

Upgrading to version 7.2.4 or 7.3-rc1 eliminates this vulnerability. Applying the patch edae84e5461749ed9adf9fcf5c6e075381040ac3/60a42d510113f46de47e86a84bf5758597644487 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion