CVE-2026-89535

Received Received - Intake

Use-After-Free in Linux Kernel svcrdma

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which frees the cm_id. rpcrdma_rn_unregister() follows, but between those two calls the transport's sc_rn entry is still installed in the device's rd_xa. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the now-freed sc_cm_id. Move rpcrdma_rn_unregister() before rdma_destroy_id() so the transport's notification entry is removed from the xarray before the cm_id it references is destroyed. Also guard the sc_cm_id dereference with a NULL check: the following patches introduce paths that reach svc_rdma_free() with sc_cm_id == NULL (listener create failure, ADDR_CHANGE replacement failure).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89535

EUVD

EUVD-2026-76441

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the svcrdma module. The issue occurs when rpcrdma_rn_unregister is called after rdma_destroy_id, which can lead to a use-after-free scenario. The cm_id is freed before its associated transport's notification entry is removed, potentially causing a concurrent operation to access freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's svcrdma module and requires kernel-level inspection. Detection involves checking kernel logs for crashes or errors related to svc_rdma_free() or rdma_destroy_id(). Commands like dmesg, journalctl -k, or checking for kernel oops messages may help identify issues. No direct network commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service condition or execute arbitrary code with kernel privileges. Systems running vulnerable Linux kernel versions with the svcrdma module enabled may be affected.

Mitigation Strategies

Apply the kernel patch that reorders rpcrdma_rn_unregister() before rdma_destroy_id() and adds NULL checks for sc_cm_id. Update to a patched kernel version. If immediate patching is not possible, consider disabling the svcrdma service if not in use to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-89535. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70