CVE-2026-89535

CVE CVE-2026-89535EUVD EUVD-2026-76441Published 2026-09-11T19:44:13.000ZLast changed 2026-09-13T06:30:32.000ZCVSS 8.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which frees the cm_id. rpcrdma_rn_unregister() follows, but between those two calls the transport's sc_rn entry is still installed in the device's rd_xa. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the now-freed sc_cm_id. Move rpcrdma_rn_unregister() before rdma_destroy_id() so the transport's notification entry is removed from the xarray before the cm_id it references is destroyed. Also guard the sc_cm_id dereference with a NULL check: the following patches introduce paths that reach svc_rdma_free() with sc_cm_id == NULL (listener create failure, ADDR_CHANGE replacement failure).

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 0; c4de97f7c45434985e5dbf2d6ccc9eca676e37fe <9f2f5d0999364c7070306cd422d8babc2621070d; patch: 7.2.4; 6.12; c4de97f7c45434985e5dbf2d6ccc9eca676e37fe <cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9; patch: 6.18.51; c4de97f7c45434985e5dbf2d6ccc9eca676e37fe <4488e912973773d64368828acf3b8e39d93650ae; patch: 7.3-rc1

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.