CVE-2026-89534
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
63/100
Published: 2026-09-11
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Adjacent
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free. NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.
Affected Software (9)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | d1b586e75ec619dde1af47e21a41a6b1b51874c2 < 2a68aeb2de8ad0fef9c50e73a50622a35c6af1a8 |
| Linux | Linux | d1b586e75ec619dde1af47e21a41a6b1b51874c2 < 65f0f82f20334e76acaf29087a59af7b3b9699ed |
| Linux | Linux | d1b586e75ec619dde1af47e21a41a6b1b51874c2 < 673e358ab7c11f8cec223c6a36a793056a67facd |
| Linux | Linux | d1b586e75ec619dde1af47e21a41a6b1b51874c2 < 01500306e1d50de7ca7a2cdcdfa28ac0523eb747 |
| Linux | Linux | 2f84d6e8b0a7093758d8da19cec111140e7b6d41 |
| Linux | Linux | 5cd069ad1cf7fb46af31f0dbe2850868335f5272 |
| Linux | Linux | 6.1.191 < 6.2 |
| Linux | Linux | 6.6.160 < 6.7 |
| Linux | Linux | 6.11 |