CVE-2026-89510

RDMA/cxgb4: Cancel reg_work before freeing device on remove

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cxgb4: Cancel reg_work before freeing device on remove

c4iw_uld_state_change() queues reg_work to register the RDMA device.
c4iw_remove() can free ctx->dev while this work is pending or running,
leaving c4iw_register_device() accessing the freed device.

Cancel reg_work before removing the device. The registration work can
tear down ctx->dev when registration fails, so do not unregister or
deallocate it again in that case.

This issue was found by an in-house static analysis tool.

Analysis

Technical impact

In the Linux kernel’s RDMA/cxgb4 driver, a registration work queue (reg_work) can be scheduled while an RDMA device is simultaneously being removed. If the device context (ctx->dev) is freed while this work is pending or running, the registration routine may access the already‑deallocated memory, resulting in a use‑after‑ crash, potentially disrupting system availability. The bug was identified by static analysis and is fixed by cancelling the registration work before the device is freed. The weakness corresponds to CWE-825.

Affected Systems

The vulnerability applies to any Linux system that includes the cxgb4 RDMA driver within the kernel. The vendor list indicates Linux kernels themselves; specific kernel versions are not enumerated in the CVE data, so all builds that contain this driver are potentially exposed until a patch is applied.

Risk and Exploitability

CVSS score is 7.8, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The likely attack vector is local kernel access; it is inferred that an attacker must trigger a device removal while registration work is queued to exploit the weakness. The effect is expected to be a kernel crash or process termination rather than arbitrary code execution, as the description does not state such outcomes.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5`	affected	< e6e79e7be87c5ea92728060a3d7fb56890a91e45
`1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5`	affected	< 672ee1981db10569ec96030bddb322f18382ec04
`1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5`	affected	< 4681e731db07769846901cfabdd3e53f765eb9d3
`1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5`	affected	< 3265d558dfafab8f12f5fba06ebbf15cae9f3225
`1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5`	affected	< fe9c591026c576d8b1f72aab5e4cd67350530763
`1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5`	affected	< 85f438382a865a4dc4c50e6b884310bb2b60fc4d
`1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5`	affected	< 320e5258a53af0abc5abd9eb01519a48bab2dee8
`1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5`	affected	< a7100601aa1a39f799a566acce10db20eaf4b7f2

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5,fe9c591026c576d8b1f72aab5e4cd67350530763)`	affected	code_commit	—
`[85f438382a865a4dc4c50e6b884310bb2b60fc4d,320e5258a53af0abc5abd9eb01519a48bab2dee8)`	affected	code_commit	—
`[1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5,a7100601aa1a39f799a566acce10db20eaf4b7f2)`	affected	code_commit	—
`[1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5,fe9c591026c576d8b1f72aab5e4cd67350530763)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.15`	affected	semver	—
`[0,4.15)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that implements cancellation of reg_work before device removal, addressing the use-after-free issue (CWE-825).
If an immediate update is unavailable, unload or disable the cxgb4 RDMA driver to clear any pending reg_work and prevent access to freed device context, then monitor system logs for registration errors.
Plan and schedule kernel upgrades across all impacted hosts to ensure the patch is uniformly applied, and validate stability through post‑upgrade monitoring.

Generated by OpenCVE AI on September 15, 2026 at 22:23 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.176% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/320e5258a53af0abc5abd9eb01519a48bab2dee8
https://git.kernel.org/stable/c/3265d558dfafab8f12f5fba06ebbf15cae9f3225
https://git.kernel.org/stable/c/4681e731db07769846901cfabdd3e53f765eb9d3
https://git.kernel.org/stable/c/672ee1981db10569ec96030bddb322f18382ec04
https://git.kernel.org/stable/c/85f438382a865a4dc4c50e6b884310bb2b60fc4d
https://git.kernel.org/stable/c/a7100601aa1a39f799a566acce10db20eaf4b7f2
https://git.kernel.org/stable/c/e6e79e7be87c5ea92728060a3d7fb56890a91e45
https://git.kernel.org/stable/c/fe9c591026c576d8b1f72aab5e4cd67350530763
https://nvd.nist.gov/vuln/detail/CVE-2026-89510
https://www.cve.org/CVERecord?id=CVE-2026-89510

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3265d558dfafab8f12f5fba06ebbf15cae9f3225 https://git.kernel.org/stable/c/4681e731db07769846901cfabdd3e53f765eb9d3 https://git.kernel.org/stable/c/672ee1981db10569ec96030bddb322f18382ec04 https://git.kernel.org/stable/c/e6e79e7be87c5ea92728060a3d7fb56890a91e45

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89510 https://www.cve.org/CVERecord?id=CVE-2026-89510
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device. Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case. This issue was found by an in-house static analysis tool.
Title		RDMA/cxgb4: Cancel reg_work before freeing device on remove
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/320e5258a53af0abc5abd9eb01519a48bab2dee8 https://git.kernel.org/stable/c/85f438382a865a4dc4c50e6b884310bb2b60fc4d https://git.kernel.org/stable/c/a7100601aa1a39f799a566acce10db20eaf4b7f2 https://git.kernel.org/stable/c/fe9c591026c576d8b1f72aab5e4cd67350530763