CVE-2026-89509 - Vulnerability Details

- RDMA/ionic: Embed counter driver data in rdma_counter allocation

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ionic: Embed counter driver data in rdma_counter allocation

Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdma_counter using
rdma_zalloc_drv_obj()") requires drivers implementing counter ops to
embed struct rdma_counter in a driver-specific struct, register its size
via INIT_RDMA_OBJ_SIZE, and provide a counter_init callback.

The ionic driver was merged without this adaptation, causing a NULL
pointer dereference in alloc_and_bind() since rdma_zalloc_drv_obj()
allocates zero bytes when size_rdma_counter is unset.

Consolidate struct ionic_counter into a new struct ionic_rdma_counter
that embeds struct rdma_counter, replace the xarray with a lightweight
ida for ID allocation, and add the required counter_init and
INIT_RDMA_OBJ_SIZE declarations.

Published: 2026-09-11

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises because the ionic RDMA driver fails to register the size of its embedded rdma_counter structure during module creation. As a result, rdma_zalloc_drv_obj() allocates zero bytes for the counter, and a subsequent NULL pointer dereference in alloc_and_bind() triggers a kernel panic. The effect is a system‑wide crash. The weakness is a NULL pointer dereference (CWE‑476).

Affected Systems

All Linux kernel releases that ship the ionic RDMA driver without the commit that registers INIT_RDMA_OBJ_SIZE are affected. The description implicitly indicates that any system with that version of the driver and the driver loaded is at risk; this is inferred from the commit context and the mention that the ionic driver was merged without the necessary adaptation. If RDMA is disabled or the driver is not loaded, the vulnerability does not manifest.

Risk and Exploitability

The CVSS v3.1 score of 4.1 classifies the flaw as low severity. The EPSS score of <1% suggests a very low likelihood of real‑world exploitation. The vulnerability is not listed in CISA KEV. Exploitation would require the ability to load or already have the faulty ionic driver active, implying root or privileged module load rights. If achieved, the attacker would cause an immediate kernel crash, resulting in a denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ea4c399642b85dc30f44d90ee805c6a18fa03062`	affected	< c98197ee3cd28288da13dc9881bb9e74daa7cbbc
`ea4c399642b85dc30f44d90ee805c6a18fa03062`	affected	< 08b8630b557828aedb1d9ef0a6e2ec421f334ee2
`ea4c399642b85dc30f44d90ee805c6a18fa03062`	affected	< cf3ebd89e754015625fee90aa938f6bc79a2c974

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ea4c399642b85dc30f44d90ee805c6a18fa03062,c98197ee3cd28288da13dc9881bb9e74daa7cbbc)`	affected	code_commit	—
`[ea4c399642b85dc30f44d90ee805c6a18fa03062,08b8630b557828aedb1d9ef0a6e2ec421f334ee2)`	affected	code_commit	—
`[ea4c399642b85dc30f44d90ee805c6a18fa03062,cf3ebd89e754015625fee90aa938f6bc79a2c974)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.18`	affected	semver	—
`[0,6.18)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains commit 7e53b31 or later so the ionic RDMA driver correctly registers the counter size and performs initialization.
If a kernel upgrade cannot be performed immediately, blacklist or unload the ionic RDMA driver to prevent it from loading and avoid the crash.
Enforce strict module‑signing policies and limit module load capabilities to trusted users; monitor kernel logs for RDMA activity to detect accidental or malicious loading attempts.

Generated by OpenCVE AI on September 13, 2026 at 09:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00198.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/08b8630b557828aedb1d9ef0a6e2ec421f334ee2
https://git.kernel.org/stable/c/c98197ee3cd28288da13dc9881bb9e74daa7cbbc
https://git.kernel.org/stable/c/cf3ebd89e754015625fee90aa938f6bc79a2c974
https://nvd.nist.gov/vuln/detail/CVE-2026-89509
https://www.cve.org/CVERecord?id=CVE-2026-89509

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89509 https://www.cve.org/CVERecord?id=CVE-2026-89509
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdma_counter allocation Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj()") requires drivers implementing counter ops to embed struct rdma_counter in a driver-specific struct, register its size via INIT_RDMA_OBJ_SIZE, and provide a counter_init callback. The ionic driver was merged without this adaptation, causing a NULL pointer dereference in alloc_and_bind() since rdma_zalloc_drv_obj() allocates zero bytes when size_rdma_counter is unset. Consolidate struct ionic_counter into a new struct ionic_rdma_counter that embeds struct rdma_counter, replace the xarray with a lightweight ida for ID allocation, and add the required counter_init and INIT_RDMA_OBJ_SIZE declarations.
Title		RDMA/ionic: Embed counter driver data in rdma_counter allocation
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/08b8630b557828aedb1d9ef0a6e2ec421f334ee2 https://git.kernel.org/stable/c/c98197ee3cd28288da13dc9881bb9e74daa7cbbc https://git.kernel.org/stable/c/cf3ebd89e754015625fee90aa938f6bc79a2c974

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:55.336Z

Updated: 2026-09-11T19:43:55.336Z

Reserved: 2026-09-11T19:38:34.716Z

Link: CVE-2026-89509

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:33.273

Modified: 2026-09-11T20:19:33.273

Link: CVE-2026-89509

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:55Z

Links: CVE-2026-89509 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T09:30:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object