CVE-2026-89535

A flaw was found in the svcrdma module of the Linux kernel. A use-after-free vulnerability can occur due to an incorrect order of operations during the teardown of an RDMA (Remote Direct Memory Access) transport. If a device unregistration process happens concurrently, it can attempt to access a memory region that has already been freed, potentially leading to system instability or denial of service.

An svcrdma teardown race can leave the transport notification entry installed in the RDMA device xarray after rdma_destroy_id has already freed sc_cm_id. A concurrent ib_unregister_device notification walk can then dispatch svc_rdma_xprt_done against state that references the freed cm_id, making this a UAF candidate in the kernel RDMA server transport path. At minimum this can cause a local denial of service via kernel crash or teardown failure. In the worst still defensible interpretation, memory corruption from the stale notification path may allow confidentiality or integrity impact and should be reviewed manually. For the CVSS the PR:L is used for the paranoid score because delegated RDMA management, reduced capability root, container root, or service accounts may be able to influence the transport lifecycle without full host administration. The issue is not directly Internet reachable and practical triggering usually requires a local or trusted RDMA/NFS server environment with concurrent device unregister or reset activity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.