Description
In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails

When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE,
it creates a replacement listener cm_id and returns 1, telling
the CM core to destroy the old one. If the replacement allocation
fails, sc_cm_id still points at the old cm_id that the CM core is
about to destroy. Any subsequent dereference of sc_cm_id --
such as svc_rdma_detach()'s rdma_disconnect() call -- is a
use-after-free.

NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s
rdma_disconnect() call against NULL so that the listener can
be torn down safely when the server shuts down.
Published: 2026-09-11
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via use‑after‑free in Linux kernel
Action: Patch
AI Analysis

Impact

An upstream fix addresses a use‑after‑free in the svcrdma module of the Linux kernel. When an RDMA address‑change event occurs the listener replacement handler allocates a new cm_id. If that allocation fails the module fails to clear a stored pointer, leaving a dangling reference that is later dereferenced during a detach. The resulting use‑after‑free can crash the kernel, causing a denial of service.

Affected Systems

All Linux kernel builds that contain the svcrdma listener code prior to the commit that clears sc_cm_id are affected. No specific version list is provided, but the issue exists in any kernel that had not yet incorporated the change.

Risk and Exploitability

The CVSS score is 5.9, indicating moderate severity. The EPSS score is below 1 %, showing a very low probability that the vulnerability will be actively exploited. The vulnerability is not listed in the CISA KEV catalog. Exposing the kernel to RDMA address‑change events is required for exploitation; it is inferred that this would normally require either local or elevated privileges, but the description does not state the exact prerequisites.

Generated by OpenCVE AI on September 13, 2026 at 04:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to the latest stable release that incorporates the upstream fix for svcrdma
  • If an immediate kernel upgrade is not possible, disable or unload the rdma kernel module to eliminate the attack surface
  • As a temporary measure, manually apply the upstream patch that clears sc_cm_id on allocation failure and rebuild the kernel

Generated by OpenCVE AI on September 13, 2026 at 04:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free. NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.
Title svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:30:31.103Z

Reserved: 2026-09-11T19:38:34.720Z

Link: CVE-2026-89534

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:36.390

Modified: 2026-09-13T07:17:15.650

Link: CVE-2026-89534

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-11T19:44:12Z

Links: CVE-2026-89534 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T04:15:13Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference