The vulnerability in the Linux kernel RDMA ucma subsystem stemmed from the ucma_write_cm_event() function re-reading ctx->file multiple times without holding the necessary handler lock. This allowed ctx->file to be swapped mid-operation by ucma_migrate_id(), causing list_add_tail() to corrupt the event list by manipulating it under the wrong mutex. The corruption leads to a kernel BUG and leaves the mutex locked indefinitely, causing deadlock for subsequent writers. Additionally, the uevent remains stranded on a list that is not cleaned up, potentially causing resource leaks. The device file /dev/infiniband/rdma_cm is world-writable (0666), enabling unprivileged users to trigger this condition. The resolution was to take the handler lock in ucma_write_cm_event(), aligning with the locking strategy used in ucma_cleanup_mc_events(), ensuring ctx->file is not changed concurrently during event queuing.

The vulnerability can cause kernel list corruption leading to a kernel BUG and deadlock, which can freeze kernel threads waiting on the locked mutex. It also results in resource leaks due to stranded events on unwalked lists. Because the device file is world-writable, unprivileged users can exploit this to cause denial of service conditions on the system. There is no indication of privilege escalation or arbitrary code execution from the provided data.

A fix has been implemented in the Linux kernel to take the handler lock in ucma_write_cm_event(), preventing concurrent modification of ctx->file during event queuing. Users should update to the fixed kernel version once available. No additional mitigation is indicated or required beyond applying the official fix.