CVE-2026-89510

CVE CVE-2026-89510EUVD EUVD-2026-76416Published 2026-09-11T19:43:55.000ZLast changed 2026-09-14T12:00:36.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device. Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case. This issue was found by an in-house static analysis tool.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 <fe9c591026c576d8b1f72aab5e4cd67350530763; patch: 7.2.4; 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 <85f438382a865a4dc4c50e6b884310bb2b60fc4d; 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 <4681e731db07769846901cfabdd3e53f765eb9d3; 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 <e6e79e7be87c5ea92728060a3d7fb56890a91e45; patch: 6.18.50; 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 <320e5258a53af0abc5abd9eb01519a48bab2dee8; patch: 6.1.188; patch: 5.10.270; patch: 6.6.157; 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 <3265d558dfafab8f12f5fba06ebbf15cae9f3225; 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 <a7100601aa1a39f799a566acce10db20eaf4b7f2; patch: 7.3-rc1; patch: 0; patch: 5.15.221; patch: 6.12.109; 4.15; 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 <672ee1981db10569ec96030bddb322f18382ec04

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.