CVE-2026-89509: Linux Kernel RDMA Use-After-Free Vulnerability

CVE-2026-89509 Overview

CVE-2026-89509 is a NULL pointer dereference vulnerability in the Linux kernel's RDMA/ionic driver. The flaw exists in the alloc_and_bind() code path because the ionic driver was merged without adapting to the counter allocation contract introduced by commit 7e53b31acc7f ("RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj()"). Drivers implementing counter operations must embed struct rdma_counter in a driver-specific structure, register its size via INIT_RDMA_OBJ_SIZE, and provide a counter_init callback. Because the ionic driver did not do this, rdma_zalloc_drv_obj() allocates zero bytes when size_rdma_counter is unset, leading to a dereference of unallocated memory.

Critical Impact
Local kernel operations that exercise ionic RDMA counter allocation can trigger a NULL pointer dereference, resulting in a kernel crash and denial of service on affected systems.

Affected Products

Linux kernel builds containing the RDMA/ionic driver prior to the fix
Systems using Pensando/AMD ionic RDMA hardware with the affected driver
Distribution kernels that backported the ionic RDMA driver without the counter allocation adaptation

Discovery Timeline

2026-09-11 - CVE-2026-89509 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89509

Vulnerability Analysis

The vulnerability resides in the Remote Direct Memory Access (RDMA) subsystem of the Linux kernel, specifically in the ionic driver responsible for AMD/Pensando RDMA-capable NICs. The RDMA core provides a generic mechanism for allocating counter objects via rdma_zalloc_drv_obj(), which relies on each driver declaring the total allocation size through the INIT_RDMA_OBJ_SIZE macro. This size must include both the generic struct rdma_counter and any driver-specific fields.

The ionic driver was merged after commit 7e53b31acc7f changed this contract but did not adopt the new pattern. It maintained its own struct ionic_counter decoupled from struct rdma_counter and tracked identifiers through an xarray rather than embedding the object as the core now requires. When RDMA core code invokes alloc_and_bind(), rdma_zalloc_drv_obj() allocates zero bytes because size_rdma_counter remains unset, and subsequent access to counter fields dereferences an invalid pointer.

Root Cause

The root cause is a missing adaptation to an updated internal kernel API. The ionic driver lacks a counter_init callback, does not register a nonzero size_rdma_counter, and does not embed struct rdma_counter in its driver-specific structure. The result is a zero-size allocation followed by pointer arithmetic on that allocation, which manifests as a NULL pointer dereference [CWE-476].

Attack Vector

Exploitation requires local privileges to trigger RDMA counter binding operations on a system with the ionic RDMA driver loaded. The condition is reachable through normal RDMA counter management workflows rather than crafted network traffic. The observable impact is a kernel oops or panic leading to denial of service. No evidence of code execution or privilege escalation has been published.

The upstream fix consolidates struct ionic_counter into a new struct ionic_rdma_counter that embeds struct rdma_counter, replaces the xarray with a lightweight ida for ID allocation, and adds the required counter_init and INIT_RDMA_OBJ_SIZE declarations. See the Kernel Git Commit cf3ebd8 and related backports for implementation details.

Detection Methods for CVE-2026-89509

Indicators of Compromise

Kernel oops or panic messages referencing alloc_and_bind, rdma_zalloc_drv_obj, or the ionic RDMA module in dmesg or /var/log/kern.log
Unexpected reboots on hosts equipped with AMD/Pensando ionic RDMA hardware following counter binding operations
RDMA counter management commands (rdma statistic) that fail or terminate the caller with kernel faults

Detection Strategies

Inventory Linux hosts loading the ionic RDMA kernel module and compare running kernel versions against the fixed commits 08b8630, c98197ee, and cf3ebd8
Alert on kernel crash telemetry that includes RDMA counter allocation symbols in the backtrace
Correlate reboot events on RDMA-enabled hosts with prior rdma statistic or counter binding activity

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging platform for pattern analysis
Track loaded kernel modules across the fleet and flag hosts running vulnerable ionic driver builds
Monitor for repeated RDMA subsystem faults that could indicate exploitation attempts or misconfiguration

How to Mitigate CVE-2026-89509

Immediate Actions Required

Apply the upstream kernel patch series referenced by commits 08b8630, c98197ee, and cf3ebd8 or install a vendor kernel update that incorporates the fix
On hosts where patching is not immediately possible and RDMA functionality is not required, unload the ionic RDMA module to eliminate the vulnerable code path
Restrict local access on systems running the affected driver until the patched kernel is deployed

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the Kernel Git Commit 08b8630, Kernel Git Commit c98197ee, and Kernel Git Commit cf3ebd8 for the authoritative patch content. Distribution vendors are expected to backport the fix into supported kernel streams.

Workarounds

Blacklist the ionic RDMA module on systems that do not require RDMA offload from AMD/Pensando adapters
Limit administrative access to the RDMA subsystem to reduce the probability of triggering the crash path
Enable kernel crash dump collection (kdump) so that any occurrence produces actionable forensic data

bash

# Prevent the vulnerable ionic RDMA module from loading until patched
echo 'blacklist ionic_rdma' | sudo tee /etc/modprobe.d/disable-ionic-rdma.conf
sudo rmmod ionic_rdma 2>/dev/null || true
sudo update-initramfs -u