CVE-2026-89535
Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which frees the cm_id. rpcrdma_rn_unregister() follows, but between those two calls the transport's sc_rn entry is still installed in the device's rd_xa. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the now-freed sc_cm_id. Move rpcrdma_rn_unregister() before rdma_destroy_id() so the transport's notification entry is removed from the xarray before the cm_id it references is destroyed. Also guard the sc_cm_id dereference with a NULL check: the following patches introduce paths that reach svc_rdma_free() with sc_cm_id == NULL (listener create failure, ADDR_CHANGE replacement failure).
How to fix
- Linux Linuxfcd4a752ac840d39356f4d2a424d3aca4e39716b, 9f2f5d0999364c7070306cd422d8babc2621070d, cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9, 4488e912973773d64368828acf3b8e39d93650ae or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c4de97f7c45434985e5dbf2d6ccc9eca676e37fe ≤ v < fcd4a752ac840d39356f4d2a424d3aca4e39716b, c4de97f7c45434985e5dbf2d6ccc9eca676e37fe ≤ v < 9f2f5d0999364c7070306cd422d8babc2621070d, c4de97f7c45434985e5dbf2d6ccc9eca676e37fe ≤ v < cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9, c4de97f7c45434985e5dbf2d6ccc9eca676e37fe ≤ v < 4488e912973773d64368828acf3b8e39d93650ae, 6.12 | fcd4a752ac840d39356f4d2a424d3aca4e39716b, 9f2f5d0999364c7070306cd422d8babc2621070d, cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9, 4488e912973773d64368828acf3b8e39d93650ae |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.