A race condition in the Linux kernel RDMA/ucma subsystem could allow a local authenticated attacker to achieve system instability or potential code execution.

This is a race condition vulnerability (CWE-362) located in the ucma_write_cm_event function, where improper locking during file migration allows for list corruption. The attacker must have local access and low privileges (PR:L) to interact with the RDMA subsystem.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. While exploitation requires local access, a successful attack results in kernel-level corruption, which can lead to system crashes (Denial of Service) or potential escalation of privileges, compromising the integrity and availability of the host system.

Immediate Action: Update the Linux kernel to version 6.18.50, 7.2.4, or later to incorporate the necessary locking fixes.

Proactive Monitoring: Monitor system logs for kernel BUG messages or list corruption warnings, particularly when utilizing RDMA services.

Compensating Controls: Restrict access to RDMA interfaces and kernel-level drivers to only authorized users and services to reduce the attack surface for local threats.

Public Exploit Available: Unknown.

Given the potential for kernel-level impact and the severity of the flaw, organizations should prioritize patching the Linux kernel across all affected environments. Administrators should schedule maintenance windows for kernel updates to versions 6.18.50 or 7.2.4 to ensure long-term system stability and security.