The Linux kernel RDMA/uverbs subsystem had a vulnerability where three drivers (mthca, irdma, siw) expected non-NULL user data (udata) in the reg_mr ioctl method but the original implementation did not pass this data correctly. This could lead to a NULL pointer dereference crash if a malicious userspace deliberately omitted the udata. The issue was fixed by adding UVERBS_ATTR_UHW to the UVERBS_METHOD_REG_MR method, ensuring proper handling of the user hardware data. The vulnerability is theoretical in nature as normal usage in rdma-core does not expose this condition.

A malicious userspace process could trigger a NULL pointer dereference in the affected drivers, causing a kernel crash (denial of service). There is no indication of privilege escalation or data corruption. The vulnerability is unlikely to occur in normal operation but could be exploited by crafted userspace code to cause system instability.

A fix has been applied in the Linux kernel by adding UVERBS_ATTR_UHW to the UVERBS_METHOD_REG_MR method to properly handle the user hardware data. Users should update to the fixed kernel version once available. No additional mitigation is required as normal userspace libraries do not expose this condition.