CVE-2026-89510

A flaw was found in the Linux kernel's RDMA/cxgb4 component. This vulnerability occurs when the c4iw_remove() function frees a device while its registration work (reg_work) is still pending or actively running. This timing issue can lead to the c4iw_register_device() function attempting to access memory that has already been deallocated. The primary consequence of this use-after-free vulnerability is system instability, which could potentially lead to a denial of service.

A race in the RDMA cxgb4 remove path can free ctx dev while reg_work is still pending or running. The queued registration worker can then enter c4iw_register_device and access the freed device object, which makes this a kernel use after free candidate rather than a simple warning or resource leak. The most direct impact is a local denial of service via kernel crash during device remove, driver teardown, or related error recovery paths. For the CVSS the PR:L is used for the paranoid score because some environments delegate device or network administration to a reduced capability root, container root, or service account rather than full host root. The issue is not directly network reachable from packet traffic and normally requires local control over device lifecycle or a driver state transition. Impact is at least availability loss and in the worst still defensible case may include confidentiality and integrity impact due to kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.