CVE-2026-89534

A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when the system attempts to handle an RDMA (Remote Direct Memory Access) address change, and a critical memory allocation fails. This can lead to a 'use-after-free' error, where the system tries to access memory that has already been released. A local attacker could potentially exploit this to cause a system crash, leading to a denial of service, or in some scenarios, execute unauthorized code.

An svcrdma listener can keep a stale sc_cm_id pointer when RDMA_CM_EVENT_ADDR_CHANGE creates a replacement listener and that allocation fails. The CM core is then told to destroy the old cm_id while sc_cm_id still points to it, so a later path such as svc_rdma_detach() can pass the freed object to rdma_disconnect() and trigger a use-after-free. For the CVSS the PR:L is used for the paranoid score because a local user may be able to influence memory pressure or teardown timing, while reliable triggering usually also depends on RDMA service state and address change events. The issue is not directly reachable over normal IP packet traffic, but it affects NFS over RDMA deployments where RDMA CM events and server shutdown or detach paths are present. Impact is at least denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.