CVE-2026-89534svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free. NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d1b586e75ec619dde1af47e21a41a6b1b51874c2 before 65f0f82f20334e76acaf29087a59af7b3b9699ed; from d1b586e75ec619dde1af47e21a41a6b1b51874c2 before 673e358ab7c11f8cec223c6a36a793056a67facd; from d1b586e75ec619dde1af47e21a41a6b1b51874c2 before 01500306e1d50de7ca7a2cdcdfa28ac0523eb747 | CNA record |
References
- https://git.kernel.org/stable/c/65f0f82f20334e76acaf29087a59af7b3b9699ed
- https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd
- https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.