CVE-2026-89534: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89534 Overview

CVE-2026-89534 is a use-after-free vulnerability in the Linux kernel's svcrdma (SUNRPC over RDMA server) subsystem. The flaw resides in svc_rdma_listen_handler(), which processes RDMA_CM_EVENT_ADDR_CHANGE events by allocating a replacement listener cm_id and instructing the Connection Manager (CM) core to destroy the old one. When the replacement allocation fails, sc_cm_id continues pointing at the cm_id that the CM core is about to free. Subsequent dereferences, such as the rdma_disconnect() call in svc_rdma_detach(), operate on freed memory.

Critical Impact
An adversary with adjacent-network access to an RDMA-capable NFS server can trigger a use-after-free that may lead to kernel memory corruption or denial of service.

Affected Products

Linux kernel builds with CONFIG_SUNRPC_XPRT_RDMA enabled
NFS-over-RDMA server deployments (svcrdma transport)
Distributions shipping kernels prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-89534 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89534

Vulnerability Analysis

The vulnerability affects the kernel's server-side RDMA transport used by the NFS server (svcrdma). RDMA CM events flow through svc_rdma_listen_handler(), which handles address changes on the listening interface. On receiving RDMA_CM_EVENT_ADDR_CHANGE, the handler allocates a new listener cm_id and returns 1, signaling the CM core to tear down the prior cm_id.

When the replacement allocation fails, the transport's sc_cm_id field is not updated. It continues to reference the cm_id that the CM core will free upon the handler's return. Any later access to sc_cm_id, most notably rdma_disconnect() inside svc_rdma_detach() during server shutdown, dereferences freed memory. This can corrupt kernel memory, crash the host, or be leveraged for further kernel-space exploitation.

Root Cause

The root cause is a missing pointer invalidation on an error path [CWE-416]. The listener handler does not clear sc_cm_id when the replacement cm_id cannot be created, and downstream code does not guard the rdma_disconnect() call against a dangling pointer. The fix sets sc_cm_id to NULL on the failure path and adds a NULL check in svc_rdma_detach() so shutdown can proceed safely.

Attack Vector

Exploitation requires the ability to induce an RDMA_CM_EVENT_ADDR_CHANGE event against an NFS-over-RDMA server and to cause the replacement cm_id allocation to fail. This is an adjacent-network attack path against hosts exposing RDMA transports on shared fabrics such as InfiniBand or RoCE segments. Under memory pressure or induced allocation failures, the resulting use-after-free triggers when the server later tears down the transport.

See the upstream fix commits for the exact code change: Kernel Git Commit 01500306 and Kernel Git Commit 673e358a.

Detection Methods for CVE-2026-89534

Indicators of Compromise

Kernel oops or panic traces referencing svc_rdma_detach, rdma_disconnect, or svc_rdma_listen_handler in dmesg.
KASAN reports flagging use-after-free within the svcrdma subsystem.
Unexpected NFS-over-RDMA transport teardowns coinciding with fabric address changes.

Detection Strategies

Inventory hosts running kernels with CONFIG_SUNRPC_XPRT_RDMA=y that predate the referenced stable commits.
Correlate RDMA CM address-change events with subsequent kernel warnings or NFS service restarts.
Run KASAN-enabled test kernels in staging to surface the use-after-free during controlled fabric events.

Monitoring Recommendations

Ship kernel logs to a central log store and alert on stack traces containing svcrdma symbols.
Monitor RDMA subnet manager events for repeated ADDR_CHANGE notifications targeting NFS server ports.
Track NFS server availability metrics to detect anomalous transport resets on RDMA-enabled hosts.

How to Mitigate CVE-2026-89534

Immediate Actions Required

Identify NFS servers with svcrdma enabled and prioritize kernel updates on those hosts.
Apply vendor kernel updates that include the upstream fix commits 01500306 and 673e358a.
Restrict RDMA fabric access to trusted hosts using subnet-level segmentation and partition keys.

Patch Information

The fix is upstream in the Linux kernel stable tree. Apply distribution kernels that incorporate Kernel Git Commit 01500306 and Kernel Git Commit 673e358a. The patch NULLs sc_cm_id when the replacement listener allocation fails and guards rdma_disconnect() in svc_rdma_detach() against a NULL pointer.

Workarounds

Disable the NFS-over-RDMA server transport on hosts where it is not required by unloading or blacklisting the svcrdma module.
Constrain RDMA CM exposure to trusted subnets and enforce partition keys or VLAN isolation on the fabric.
Reduce memory pressure on NFS servers to lower the probability of allocation failures triggering the flaw.

bash

# Disable the svcrdma server transport on hosts that do not require NFS-over-RDMA
echo "blacklist svcrdma" | sudo tee /etc/modprobe.d/blacklist-svcrdma.conf
sudo rmmod svcrdma 2>/dev/null || true

# Verify current kernel version against patched builds provided by your distribution
uname -r