CVE-2026-89531: Linux Kernel svcrdma DoS Vulnerability

CVE-2026-89531 Overview

CVE-2026-89531 is a resource leak vulnerability in the Linux kernel's svcrdma (SUNRPC server-side Remote Direct Memory Access) subsystem. The flaw lives in handle_connect_req(), which fails to reject an incoming connection when svc_rdma_create_xprt() cannot allocate a new transport. Because the Connection Manager (CM) core treats a zero return from a CONNECT_REQUEST event handler as success, the orphaned rdma_cm_id is never destroyed. Each allocation failure under memory pressure leaks one rdma_cm_id, and a remote peer that repeatedly initiates connection attempts can amplify the leak.

Critical Impact
Remote attackers driving RDMA connection attempts against a memory-pressured NFS-over-RDMA server can trigger sustained rdma_cm_id leaks, degrading kernel memory and reducing service availability.

Affected Products

Linux kernel builds containing the svcrdma (SUNRPC server-side RDMA) transport
Systems exporting NFS over RDMA via the affected kernel versions
Distributions consuming the upstream stable kernel prior to the referenced fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89531 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89531

Vulnerability Analysis

The defect lives in the RDMA Connection Manager event path used by the kernel NFS server. When a remote peer sends an RDMA_CM_EVENT_CONNECT_REQUEST, the CM core invokes the handler, which calls svc_rdma_create_xprt() to allocate a new server transport. If that allocation fails, handle_connect_req() returns without rejecting the connection.

The CM core interprets a zero return from a CONNECT_REQUEST handler as an acknowledgment that the callee has taken ownership of the new rdma_cm_id. As a result, the CM core does not destroy the orphaned identifier, and the reference is lost inside the kernel. Every failed allocation therefore leaks one rdma_cm_id structure and its associated bookkeeping.

The upstream fix updates the handler to return a non-zero status on allocation failure, signaling the CM core to tear down the orphaned cm_id.

Root Cause

The root cause is a contract mismatch between handle_connect_req() and the RDMA CM core regarding ownership semantics on CONNECT_REQUEST events. Returning zero implies successful adoption of the new cm_id, but the handler silently discards the identifier when transport allocation fails, producing a memory leak (Memory Leak class).

Attack Vector

The attack requires network reachability to an RDMA-enabled NFS server and the ability to open RDMA connections. Under memory pressure, svc_rdma_create_xprt() fails more frequently, and a remote peer that issues repeated connection attempts amplifies the leak. The vulnerability does not by itself yield code execution or data disclosure; the impact is resource exhaustion within kernel memory. See the kernel git commit 3cf372c for the applied fix.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream commit references.

Detection Methods for CVE-2026-89531

Indicators of Compromise

Growth in kernel slab allocations tied to rdma_cm structures without a corresponding drop after client disconnects.
Repeated RDMA_CM_EVENT_CONNECT_REQUEST entries in kernel logs coinciding with allocation failure messages from svc_rdma_create_xprt().
Elevated NFS-over-RDMA connection churn from a single remote peer against a server showing memory pressure.

Detection Strategies

Monitor kernel memory counters (/proc/slabinfo, /proc/meminfo) on NFS-over-RDMA servers for unexplained upward drift in RDMA-related caches.
Correlate dmesg output for svcrdma warnings with peer connection rates observed on RDMA interfaces.
Compare running kernel version and backport status against the fix commits referenced in the upstream advisory to identify unpatched hosts.

Monitoring Recommendations

Track long-term trends in kernel slab consumption on RDMA-capable NFS servers and alert on sustained growth.
Rate-limit or log RDMA connection attempts per remote peer at the fabric or firewall layer where feasible.
Include NFS-over-RDMA hosts in regular kernel patch compliance audits and confirm coverage of the referenced stable commits.

How to Mitigate CVE-2026-89531

Immediate Actions Required

Identify all Linux hosts exporting NFS over RDMA and enumerate their running kernel versions.
Apply the upstream stable kernel updates that include the referenced fix commits, then reboot to activate the patched code path.
Where patching cannot be immediate, restrict RDMA fabric access to trusted clients only.

Patch Information

The fix modifies handle_connect_req() to return a non-zero status when svc_rdma_create_xprt() fails, causing the RDMA CM core to destroy the orphaned cm_id. Reference the upstream commits: 0944462, 1f6a14c, 3cf372c, and 6e21754. Consume the fix through your distribution's kernel update channel when available.

Workarounds

Disable NFS-over-RDMA transport on affected servers if RDMA is not operationally required.
Segment RDMA fabrics to permit connections only from authenticated, trusted peers, reducing exposure to remote amplification.
Provision additional headroom on affected hosts to delay the impact of allocation-failure-driven leaks until patches are deployed.

bash

# Check the running kernel version against patched stable releases
uname -r

# Confirm whether NFS-over-RDMA is loaded and in use
lsmod | grep -E 'svcrdma|rpcrdma'
cat /proc/fs/nfsd/portlist 2>/dev/null | grep rdma

# Temporarily unload the server-side RDMA transport if not needed
sudo modprobe -r svcrdma