A race condition in the Linux kernel RDMA/ucma component could allow a local attacker to achieve elevated privileges or cause a system crash.

The vulnerability exists in the ucma_set_ib_path() function, which fails to properly lock the event handler during concurrent operations. A local authenticated attacker can exploit this race condition to manipulate the ctx->file pointer, resulting in a use-after-free error when ucma_migrate_id() reassigns the file context.

The exploitation of this vulnerability permits a local user to potentially gain elevated system privileges or disrupt service availability through a kernel panic. While the CVSS score of 7.8 indicates a high severity, the requirement for local access restricts the immediate threat surface to users already present on the system. However, in multi-tenant or shared environments, this represents a significant risk to data integrity and system security.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later as appropriate for your distribution.

Proactive Monitoring: Monitor system logs for kernel-related crash dumps or KASAN-related reports that may indicate exploitation attempts.

Compensating Controls: Restrict access to RDMA-related interfaces and limit the ability of untrusted users to execute specialized system calls that interact with the RDMA stack.

Public Exploit Available: No

Given the potential for privilege escalation, organizations should prioritize patching the kernel across all affected infrastructure. While local access is required, this vulnerability poses a severe risk to internal security boundaries in shared hosting or containerized environments. Administrators must ensure that kernel updates are applied and verified through standard patch management cycles to mitigate the risk of local exploitation.