CVE-2026-89506

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Add UVERBS ATTR UHW to UVERBS METHOD REG MR

The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg mr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid udata can trigger a NULL udata crash in those drivers.

This never happens in real systems since in rdma-core ibv cmd reg mr ex() does not accept a udata and those three drivers don't use it, however a malicious userspace could trigger it.