CVE-2026-89534

Published: September 15, 2026Last modified: September 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free. NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.

Severity score breakdown

Status

References

• https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747
• https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd