GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89534 (GCVE-0-2026-89534)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30
VLAI
Title
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
Summary
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free. NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d1b586e75ec619dde1af47e21a41a6b1b51874c2 , < 673e358ab7c11f8cec223c6a36a793056a67facd (git)
Affected: d1b586e75ec619dde1af47e21a41a6b1b51874c2 , < 01500306e1d50de7ca7a2cdcdfa28ac0523eb747 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "673e358ab7c11f8cec223c6a36a793056a67facd",
              "status": "affected",
              "version": "d1b586e75ec619dde1af47e21a41a6b1b51874c2",
              "versionType": "git"
            },
            {
              "lessThan": "01500306e1d50de7ca7a2cdcdfa28ac0523eb747",
              "status": "affected",
              "version": "d1b586e75ec619dde1af47e21a41a6b1b51874c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails\n\nWhen svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE,\nit creates a replacement listener cm_id and returns 1, telling\nthe CM core to destroy the old one. If the replacement allocation\nfails, sc_cm_id still points at the old cm_id that the CM core is\nabout to destroy. Any subsequent dereference of sc_cm_id --\nsuch as svc_rdma_detach()\u0027s rdma_disconnect() call -- is a\nuse-after-free.\n\nNULL sc_cm_id on the failure path and guard svc_rdma_detach()\u0027s\nrdma_disconnect() call against NULL so that the listener can\nbe torn down safely when the server shuts down."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - svcrdma is the in-kernel NFS/RDMA server listen path; RDMA_CM_EVENT_ADDR_CHANGE is raised only from cma_netdev_callback on NETDEV_BONDING_FAILOVER when the bound bond MAC changes, so an attacker on the RoCE/IB storage fabric inducing active-backup failover reaches the bug, matching ADDR_CHANGE scoring for RPC-over-RDMA.\nAC:L - svc_rdma_create_listen_id() binds the replacement while the old listen cm_id still owns the port, so rdma_bind_addr() fails deterministically with EADDRINUSE/EADDRNOTAVAIL; the handler still returns 1 and the CM core frees that id, leaving a dangling sc_cm_id the attacker can arm by inducing failover.\nPR:N - The NFS/RDMA listener is already running as a network service; bonding failover and RDMA CM ADDR_CHANGE delivery perform no RPC, NFS export, or other authentication, so an adjacent fabric attacker needs no account or capability on the victim host.\nUI:N - Exploitation uses attacker-induced link failover plus subsequent listener teardown (nfsd restart/shutdown, the normal operational response once the listen endpoint is dead); no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The use-after-free corrupts the host kernel rdma_cm_id/rdma_id_private object used by nfsd\u0027s RDMA transport in the same kernel security authority and is not a VM, IOMMU, or sandbox escape.\nC:H - After the CM core destroys the listen id, sc_cm_id is a dangling pointer to a freed rdma_cm_id with an event_handler; later rdma_disconnect()/rdma_destroy_id() in svc_rdma_detach/free is a kernel heap UAF that enables arbitrary disclosure via controlled reuse.\nI:H - svc_rdma_detach() calls rdma_disconnect() on the freed cm_id and svc_rdma_free() may rdma_destroy_id() it again, yielding UAF writes, double-free, and function-pointer hijack of event_handler, so integrity impact is High per UAF guidance.\nA:H - Use-after-free of the listen rdma_cm_id during detach/free causes a kernel oops or panic even when not fully exploited, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:31.103Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd"
        },
        {
          "url": "https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747"
        }
      ],
      "title": "svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89534",
    "datePublished": "2026-09-11T19:44:12.987Z",
    "dateReserved": "2026-09-11T19:38:34.720Z",
    "dateUpdated": "2026-09-13T06:30:31.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89534",
      "date": "2026-09-17",
      "epss": "0.00218",
      "percentile": "0.12461"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89534\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:36.390\",\"lastModified\":\"2026-09-13T07:17:15.650\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsvcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails\\n\\nWhen svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE,\\nit creates a replacement listener cm_id and returns 1, telling\\nthe CM core to destroy the old one. If the replacement allocation\\nfails, sc_cm_id still points at the old cm_id that the CM core is\\nabout to destroy. Any subsequent dereference of sc_cm_id --\\nsuch as svc_rdma_detach()\u0027s rdma_disconnect() call -- is a\\nuse-after-free.\\n\\nNULL sc_cm_id on the failure path and guard svc_rdma_detach()\u0027s\\nrdma_disconnect() call against NULL so that the listener can\\nbe torn down safely when the server shuts down.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/xprtrdma/svc_rdma_transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d1b586e75ec619dde1af47e21a41a6b1b51874c2\",\"lessThan\":\"673e358ab7c11f8cec223c6a36a793056a67facd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d1b586e75ec619dde1af47e21a41a6b1b51874c2\",\"lessThan\":\"01500306e1d50de7ca7a2cdcdfa28ac0523eb747\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/xprtrdma/svc_rdma_transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T09:58:39+00:00",
      "cve": "CVE-2026-89534",
      "id": "CVE-2026-89534",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "199",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89534.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T15:37:15Z",
      "cve": "CVE-2026-89534",
      "id": "CVE-2026-89534",
      "initial_release_date": "2026-09-12T16:26:37Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89534",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89534.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.