CVE-2026-89527 Overview
CVE-2026-89527 is a Linux kernel vulnerability in the SUNRPC svcrdma transport layer. The flaw resides in svc_rdma_create(), which incorrectly frees a listener transport with kfree() when svc_rdma_create_listen_id() fails. This bypasses svc_xprt_free(), leaking a network namespace reference previously acquired by svc_xprt_init() via get_net_track(). The imbalance also affects module reference counting, since the caller performs its own module_put() on failure. Upstream maintainers resolved the issue by replacing the kfree() with svc_xprt_put() and taking a compensating __module_get() to keep reference counts balanced.
Critical Impact
The defect leaks kernel network namespace and module references on RDMA listener creation failure, degrading kernel resource accounting over time.
Affected Products
- Linux kernel svcrdma server-side RPC-over-RDMA transport
- Kernel builds with CONFIG_SUNRPC_XPRT_RDMA enabled
- NFS server deployments using RDMA transport
Discovery Timeline
- 2026-09-11 - CVE-2026-89527 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89527
Vulnerability Analysis
The defect lives in the server-side RPC-over-RDMA transport (svcrdma) inside the Linux kernel SUNRPC subsystem. When svc_rdma_create() attempts to construct a listener transport and the call to svc_rdma_create_listen_id() fails, the error path uses kfree(cma_xprt) to release the partially initialized svc_xprt structure.
By the time this error path runs, svc_xprt_init() has already acquired a per-transport network namespace reference through get_net_track() and initialized a kref birth reference. Calling kfree() directly skips svc_xprt_free(), which is responsible for releasing the namespace reference, invoking the transport's xpo_free operation, and dropping the module reference.
Compounding the issue, _svc_xprt_create() also performs a module_put() on xpo_create failure. Once the fix routes cleanup through svc_xprt_put() (which itself calls module_put()), the single try_module_get() would be released twice. The patch introduces a compensating __module_get() before svc_xprt_put() to preserve balance, matching the convention used in the svc_rdma_accept() error path.
Root Cause
The root cause is an incorrect deallocation primitive in the error path of svc_rdma_create(). Using kfree() on a structure that has already been initialized by svc_xprt_init() bypasses reference-count teardown for both the network namespace and the owning module, classifying this as a resource management defect (memory/reference leak).
Attack Vector
The vulnerability is triggered when RDMA listener creation fails after transport initialization. Repeated failures, whether through misconfiguration, resource pressure, or induced RDMA subsystem errors, accumulate stale namespace and module references. This can prevent network namespaces from being freed and block module unload operations. No authenticated remote exploitation path is documented, and no proof-of-concept is available.
No verified exploit code is published for this issue. See the upstream commits ac1dd6002f75 and e346ef7bcb13 for the corrective patches.
Detection Methods for CVE-2026-89527
Indicators of Compromise
- Persistent network namespaces that cannot be removed after NFS-over-RDMA services are stopped.
- rmmod failures on svcrdma or dependent SUNRPC modules due to elevated reference counts.
- Kernel log entries showing repeated svc_rdma_create_listen_id failures without matching cleanup messages.
Detection Strategies
- Audit kernel versions across NFS server fleets to identify hosts running vulnerable svcrdma code paths.
- Correlate RDMA transport creation failures in dmesg with unexpected growth in /proc/net/ namespace counts.
- Monitor lsmod reference counts for rpcrdma and svcrdma modules across reboots and service restarts.
Monitoring Recommendations
- Alert on failures returned by rpc.nfsd when binding RDMA listeners on ports such as 20049.
- Track long-lived network namespaces on NFS servers that persist beyond expected workload lifetimes.
- Feed kernel telemetry into a centralized data lake to detect anomalous SUNRPC error patterns over time.
How to Mitigate CVE-2026-89527
Immediate Actions Required
- Apply the upstream kernel patches referenced in commits ac1dd6002f75 and e346ef7bcb13 once packaged by your distribution.
- Restrict RDMA-based NFS exports to trusted management networks until patched kernels are deployed.
- Reboot affected NFS servers after patching to reset any leaked namespace or module references.
Patch Information
The fix replaces the errant kfree(cma_xprt) in svc_rdma_create() with svc_xprt_put() so the birth reference drops to zero and svc_xprt_free() performs full teardown, including releasing the network namespace acquired by get_net_track(). A preceding patch adds a NULL guard for sc_cm_id in svc_rdma_free(). A compensating __module_get() is taken before svc_xprt_put() to prevent a double module_put() when _svc_xprt_create() also releases the module reference on xpo_create failure. Refer to the kernel.org commit for the authoritative diff.
Workarounds
- Disable RPC-over-RDMA transport on the NFS server and fall back to TCP where operationally feasible.
- Unload the svcrdma module on hosts that do not require RDMA services to eliminate the vulnerable code path.
- Avoid configurations that trigger repeated listener creation failures, such as binding to unavailable RDMA devices.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
