GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89535 (GCVE-0-2026-89535)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30
VLAI
Title
svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
Summary
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which frees the cm_id. rpcrdma_rn_unregister() follows, but between those two calls the transport's sc_rn entry is still installed in the device's rd_xa. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the now-freed sc_cm_id. Move rpcrdma_rn_unregister() before rdma_destroy_id() so the transport's notification entry is removed from the xarray before the cm_id it references is destroyed. Also guard the sc_cm_id dereference with a NULL check: the following patches introduce paths that reach svc_rdma_free() with sc_cm_id == NULL (listener create failure, ADDR_CHANGE replacement failure).
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c4de97f7c45434985e5dbf2d6ccc9eca676e37fe , < 9f2f5d0999364c7070306cd422d8babc2621070d (git)
Affected: c4de97f7c45434985e5dbf2d6ccc9eca676e37fe , < cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9 (git)
Affected: c4de97f7c45434985e5dbf2d6ccc9eca676e37fe , < 4488e912973773d64368828acf3b8e39d93650ae (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9f2f5d0999364c7070306cd422d8babc2621070d",
              "status": "affected",
              "version": "c4de97f7c45434985e5dbf2d6ccc9eca676e37fe",
              "versionType": "git"
            },
            {
              "lessThan": "cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9",
              "status": "affected",
              "version": "c4de97f7c45434985e5dbf2d6ccc9eca676e37fe",
              "versionType": "git"
            },
            {
              "lessThan": "4488e912973773d64368828acf3b8e39d93650ae",
              "status": "affected",
              "version": "c4de97f7c45434985e5dbf2d6ccc9eca676e37fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id\n\nsvc_rdma_free() caches rdma-\u003esc_cm_id-\u003edevice before teardown,\nthen calls rdma_destroy_id(sc_cm_id) which frees the cm_id.\nrpcrdma_rn_unregister() follows, but between those two calls\nthe transport\u0027s sc_rn entry is still installed in the device\u0027s\nrd_xa. A concurrent ib_unregister_device walk can dispatch\nsvc_rdma_xprt_done() against the now-freed sc_cm_id.\n\nMove rpcrdma_rn_unregister() before rdma_destroy_id() so the\ntransport\u0027s notification entry is removed from the xarray before\nthe cm_id it references is destroyed.\n\nAlso guard the sc_cm_id dereference with a NULL check: the\nfollowing patches introduce paths that reach svc_rdma_free()\nwith sc_cm_id == NULL (listener create failure, ADDR_CHANGE\nreplacement failure)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote peer over routable RoCEv2 or iWARP reaches svc_rdma_free() by disconnecting an accepted connection or by forcing the post-rpcrdma_rn_register accept-error path after CONNECT_REQUEST.\nAC:H - The UAF exists only between rdma_destroy_id() and rpcrdma_rn_unregister(); triggering it requires a concurrent ib_unregister_device xarray walk (unbind, VF hot-unplug, or rxe/siw link delete) that a remote peer cannot initiate or reliably time.\nPR:N - RDMA CM CONNECT_REQUEST, accept, and DISCONNECT run before RPC or NFS authentication, and the CM handshake has no credential check, so an unauthenticated peer can drive the teardown path.\nUI:N - Opening and dropping RPC-over-RDMA connections against an already-listening NFS/RDMA service is sufficient; concurrent administrative device removal is attack complexity, not victim user interaction.\nS:U - The use-after-free of the rdma_cm_id and any double-put of the svcxprt_rdma remain in the host kernel; this is not a VM, IOMMU, or sandbox escape.\nC:H - A concurrent rpcrdma_remove_one() walk calls svc_rdma_xprt_done(), which reads the already-freed sc_cm_id (device name and route address); a reclaimable slab UAF is confidentiality High per kernel UAF guidance.\nI:H - On the accept-failure path the same callback can svc_xprt_close() a transport whose kref is already zero, calling rdma_disconnect() on the freed cm_id and dropping the kref again, yielding a double-free/UAF write primitive.\nA:H - Dereferencing the freed rdma_cm_id or double-freeing the svcxprt_rdma causes a kernel oops or panic; any use-after-free is availability High per kernel CVSS guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:32.387Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9f2f5d0999364c7070306cd422d8babc2621070d"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4488e912973773d64368828acf3b8e39d93650ae"
        }
      ],
      "title": "svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89535",
    "datePublished": "2026-09-11T19:44:13.733Z",
    "dateReserved": "2026-09-11T19:38:34.720Z",
    "dateUpdated": "2026-09-13T06:30:32.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89535",
      "date": "2026-09-16",
      "epss": "0.00512",
      "percentile": "0.42401"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89535\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:36.500\",\"lastModified\":\"2026-09-13T07:17:15.763\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsvcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id\\n\\nsvc_rdma_free() caches rdma-\u003esc_cm_id-\u003edevice before teardown,\\nthen calls rdma_destroy_id(sc_cm_id) which frees the cm_id.\\nrpcrdma_rn_unregister() follows, but between those two calls\\nthe transport\u0027s sc_rn entry is still installed in the device\u0027s\\nrd_xa. A concurrent ib_unregister_device walk can dispatch\\nsvc_rdma_xprt_done() against the now-freed sc_cm_id.\\n\\nMove rpcrdma_rn_unregister() before rdma_destroy_id() so the\\ntransport\u0027s notification entry is removed from the xarray before\\nthe cm_id it references is destroyed.\\n\\nAlso guard the sc_cm_id dereference with a NULL check: the\\nfollowing patches introduce paths that reach svc_rdma_free()\\nwith sc_cm_id == NULL (listener create failure, ADDR_CHANGE\\nreplacement failure).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/xprtrdma/svc_rdma_transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c4de97f7c45434985e5dbf2d6ccc9eca676e37fe\",\"lessThan\":\"9f2f5d0999364c7070306cd422d8babc2621070d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c4de97f7c45434985e5dbf2d6ccc9eca676e37fe\",\"lessThan\":\"cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c4de97f7c45434985e5dbf2d6ccc9eca676e37fe\",\"lessThan\":\"4488e912973773d64368828acf3b8e39d93650ae\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/xprtrdma/svc_rdma_transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4488e912973773d64368828acf3b8e39d93650ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9f2f5d0999364c7070306cd422d8babc2621070d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T12:24:10+00:00",
      "cve": "CVE-2026-89535",
      "id": "CVE-2026-89535",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "186",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89535.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:02:16Z",
      "cve": "CVE-2026-89535",
      "id": "CVE-2026-89535",
      "initial_release_date": "2026-09-12T16:26:35Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89535",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89535.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.