CVE-2026-89510: Linux Kernel RDMA Use-After-Free Vulnerability

CVE-2026-89510 Overview

CVE-2026-89510 is a use-after-free vulnerability in the Linux kernel's RDMA/cxgb4 driver. The flaw exists in the Chelsio T4/T5 RDMA driver's device removal path. The function c4iw_uld_state_change() queues reg_work to register an RDMA device asynchronously. When c4iw_remove() executes concurrently, it can free ctx->dev while the queued work is still pending or executing. The subsequent c4iw_register_device() call then accesses freed kernel memory. The issue was identified by an in-house static analysis tool and resolved by cancelling reg_work before device teardown.

Critical Impact
A local authenticated user can trigger memory corruption in kernel space, potentially escalating privileges or crashing the host through a race between RDMA device registration and removal.

Affected Products

Linux kernel versions containing the RDMA/cxgb4 driver prior to the fix
Systems using Chelsio T4/T5 series RDMA-capable network adapters
Distributions shipping stable kernel branches that have not yet backported the patch commits

Discovery Timeline

2026-09-11 - CVE-2026-89510 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89510

Vulnerability Analysis

The vulnerability is a classic use-after-free triggered by a race condition in the Chelsio cxgb4 InfiniBand driver. During upper-layer driver (ULD) state change events, c4iw_uld_state_change() schedules reg_work on a workqueue to complete asynchronous RDMA device registration. This registration path holds a reference to ctx->dev, the driver context device pointer.

When the device is removed, c4iw_remove() proceeds to free ctx->dev without waiting for pending or in-flight reg_work items to complete. The workqueue callback then dereferences the freed device structure inside c4iw_register_device(), producing kernel memory corruption. Because the registration work itself tears down ctx->dev when registration fails, redundant cleanup in the remove path can also compound the corruption.

Root Cause

The root cause is missing synchronization between the asynchronous work item scheduling and the device removal path. The driver did not cancel the queued reg_work before proceeding to free the context device, violating the object lifetime contract expected by the workqueue callback.

Attack Vector

Exploitation requires local access with sufficient privileges to trigger device state changes or driver unload events on a system exposing the cxgb4 RDMA driver. An attacker who can influence the timing of RDMA device registration and removal, for example by rapidly unbinding and rebinding the driver, can race the two code paths. Successful exploitation yields kernel memory corruption that may lead to privilege escalation or denial of service.

No public proof-of-concept exploit is currently available for CVE-2026-89510.

Detection Methods for CVE-2026-89510

Indicators of Compromise

Kernel oops or panic messages referencing c4iw_register_device, reg_work, or c4iw_remove in system logs
KASAN (Kernel Address Sanitizer) reports indicating use-after-free within the iw_cxgb4 module
Unexpected iw_cxgb4 module unload or reload events immediately preceding a system crash

Detection Strategies

Monitor dmesg and journalctl -k output for stack traces containing cxgb4 RDMA driver symbols following device removal events
Audit kernel module load and unload activity on hosts equipped with Chelsio adapters using auditd rules on the init_module and delete_module syscalls
Correlate RDMA subsystem errors with subsequent kernel instability across managed Linux fleets

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on cxgb4-related crash signatures
Track running kernel versions across the Linux estate to identify hosts still exposed to the unpatched driver
Monitor for unauthorized attempts to unload or rebind kernel modules on systems with RDMA hardware

How to Mitigate CVE-2026-89510

Immediate Actions Required

Inventory Linux hosts with Chelsio T4/T5 adapters and the iw_cxgb4 module loaded to determine exposure
Apply vendor-provided kernel updates that include the upstream fix as soon as they are available for your distribution
Restrict local access and module management privileges to trusted administrative users only

Patch Information

The upstream Linux kernel fix cancels the pending reg_work before the device is freed and avoids duplicate teardown when registration fails. The fix is available in multiple stable branches through the following commits: Kernel Commit 320e5258, Kernel Commit 3265d558, Kernel Commit 4681e731, Kernel Commit 672ee198, Kernel Commit 85f43838, Kernel Commit a7100601, Kernel Commit e6e79e7b, and Kernel Commit fe9c5910.

Workarounds

If the RDMA functionality is not required, blacklist the iw_cxgb4 module to prevent it from loading
Avoid administrative operations that unbind or rebind the cxgb4 driver on production systems until patches are applied
Limit shell and CAP_SYS_MODULE access on hosts equipped with vulnerable Chelsio hardware

bash

# Blacklist the vulnerable module until patched
echo "blacklist iw_cxgb4" | sudo tee /etc/modprobe.d/blacklist-iw_cxgb4.conf
sudo update-initramfs -u
# Verify the module is not currently loaded
lsmod | grep iw_cxgb4