{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89507 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-89507 is a high-severity vulnerability in Linux, published on 11 Sep 2026."},"fix_prompt":"Check this codebase for CVE-2026-89507 and fix it if it is affected.\n\nWhat it is: CVE-2026-89507 is a high-severity vulnerability in Linux, published on 11 Sep 2026. \nExploitation: There is no known exploitation of CVE-2026-89507 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89507/ (Markdown: https://insights.sbomify.com/CVE-2026-89507/index.md)","id":"CVE-2026-89507","markdown":"https://insights.sbomify.com/CVE-2026-89507/index.md","name":"CVE-2026-89507","record":{"aliases":["BELL-CVE-2026-89507","DEBIAN-CVE-2026-89507","GHSA-75mg-q43g-73qj","UBUNTU-CVE-2026-89507"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Lock the handler in ucma_write_cm_event()\n\nctx-\u003efile may only be changed under the handler lock and the xa_lock, which\nis what stops uevents being queued for a ctx while ucma_migrate_id() moves\nit to another file.  The CM core takes that lock before invoking\nucma_event_handler(), but the write() paths that queue uevents themselves\ndo not.\n\nucma_write_cm_event() re-reads ctx-\u003efile for each of its four dereferences,\nso ucma_migrate_id() can swap it mid-sequence:\n\n\tmutex_lock(\u0026ctx-\u003efile-\u003emut);\t\t\t/* file A */\n\tlist_add_tail(\u0026uevent-\u003elist, \u0026ctx-\u003efile-\u003eevent_list);\t/* file B */\n\tmutex_unlock(\u0026ctx-\u003efile-\u003emut);\t\t\t/* file B */\n\twake_up_interruptible(\u0026ctx-\u003efile-\u003epoll_wait);\t/* file B */\n\nThe window is the mutex_lock() itself: the writer sleeps in it while the\nmigration reassigns ctx-\u003efile.  The list_add_tail() then runs on file B's\nevent_list holding only file A's mutex:\n\n  list_add corruption. prev-\u003enext should be next (ffff888101320f30),\n    but was ffff88814a08c418. (prev=ffff88814a075c18).\n  kernel BUG at lib/list_debug.c:32!\n  Call Trace:\n   ucma_write_cm_event+0x36e/0x5e0\n\nand file A's mut is left held forever, wedging its next writer in D state.\nThe uevent is also stranded on a list ucma_cleanup_ctx_events() will not\nwalk, so it outlives its context.  /dev/infiniband/rdma_cm is 0666 and no\nRDMA device is involved, so an unprivileged user reaches all of this.\n\nTake the handler lock, as ucma_cleanup_mc_events() does; ctx-\u003ecm_id is\npinned by the ucma_get_ctx() reference.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"RDMA/ucma: Lock the handler in ucma_write_cm_event()","id":"CVE-2026-89507","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"RDMA/ucma: Lock the handler in ucma_set_ib_path()","id":"CVE-2026-89508"},"packages":[],"prev":{"headline":"RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR","id":"CVE-2026-89506"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-89507/"}