CVE-2026-89535: Linux Kernel Race Condition Vulnerability

CVE-2026-89535 Overview

CVE-2026-89535 is a use-after-free vulnerability in the Linux kernel's svcrdma (SUNRPC server over RDMA) transport code. The flaw resides in svc_rdma_free(), which calls rdma_destroy_id() on the connection manager identifier (sc_cm_id) before removing the transport's notification entry via rpcrdma_rn_unregister(). Between those two operations, a concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the freed sc_cm_id, resulting in memory corruption. The bug affects Linux kernel builds shipping the NFS-over-RDMA server transport.

Critical Impact
A race between RDMA device teardown and RPC transport cleanup can trigger a kernel use-after-free, enabling denial of service and potential remote code execution against systems serving NFS over RDMA.

Affected Products

Linux kernel svcrdma transport (SUNRPC server-side RDMA)
Systems running NFS server workloads over InfiniBand or RoCE fabrics
Kernel builds prior to the commits referenced in the upstream stable tree

Discovery Timeline

2026-09-11 - CVE-2026-89535 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89535

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] triggered by an ordering error in RDMA transport teardown. The function svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id), which releases the connection manager identifier. Only after that does rpcrdma_rn_unregister() execute to remove the transport's sc_rn entry from the device's rd_xa xarray.

During the window between rdma_destroy_id() and rpcrdma_rn_unregister(), the notification entry remains registered in the device's xarray while referencing an already-freed cm_id. A concurrent ib_unregister_device walk iterating the xarray can dispatch svc_rdma_xprt_done() against the freed sc_cm_id, dereferencing released memory.

Root Cause

The root cause is incorrect teardown ordering combined with a missing NULL check on sc_cm_id. The transport's notification registration outlives the object it points to, creating a race condition [CWE-362] observable during device unregistration. Follow-on code paths, including listener create failure and ADDR_CHANGE replacement failure, can also reach svc_rdma_free() with sc_cm_id set to NULL, compounding the exposure.

Attack Vector

Exploitation requires triggering RDMA device unregistration concurrent with server RPC transport teardown. The upstream fix reorders rpcrdma_rn_unregister() to execute before rdma_destroy_id(), ensuring the xarray entry is removed while the cm_id is still valid. The patch also guards the sc_cm_id dereference with a NULL check to cover new failure paths. Refer to the kernel commit 4488e91297 and related patches for implementation details.

Detection Methods for CVE-2026-89535

Indicators of Compromise

Kernel oops or panic messages referencing svc_rdma_xprt_done, rdma_destroy_id, or svc_rdma_free in dmesg or journalctl.
KASAN use-after-free reports mentioning sc_cm_id or rpcrdma_rn_unregister on systems with kernel address sanitizer enabled.
Unexpected NFS server crashes coinciding with RDMA device hot-unplug, driver reload, or fabric reconfiguration events.

Detection Strategies

Audit installed kernel versions against the fix commits published in the upstream stable tree references.
Monitor kernel ring buffers on NFS-over-RDMA servers for repeated svcrdma warnings correlated with ib_unregister_device activity.
Correlate InfiniBand subnet management events with NFS service restarts to identify potential race triggers.

Monitoring Recommendations

Forward kernel logs from RDMA-enabled NFS servers to a centralized logging pipeline for anomaly detection.
Alert on unexpected nfsd or kernel thread crashes on hosts that expose the svcrdma transport module.
Track loaded kernel modules (rpcrdma, svcrdma, ib_core) and their versions across the fleet to identify unpatched systems.

How to Mitigate CVE-2026-89535

Immediate Actions Required

Apply the upstream stable kernel updates that reorder rpcrdma_rn_unregister() before rdma_destroy_id() in svc_rdma_free().
Inventory hosts running NFS server exports over RDMA and prioritize patching for systems exposed to untrusted fabrics.
Restrict RDMA device management operations to trusted administrators to reduce the likelihood of racing teardown paths.

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Relevant commits include 4488e912973773d64368828acf3b8e39d93650ae, 9f2f5d0999364c7070306cd422d8babc2621070d, and cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9. Consume the fix through your Linux distribution's kernel security update channel.

Workarounds

Disable the NFS server RDMA transport where not required by unloading or blacklisting the svcrdma module until the kernel is patched.
Avoid administrative operations that trigger ib_unregister_device (driver reload, device hot-unplug) while nfsd is actively serving RDMA clients.
Segment RDMA fabrics from untrusted networks to limit exposure to attackers who could induce transport churn.

bash

# Check for the svcrdma module and unload if RDMA NFS is not required
lsmod | grep -E 'svcrdma|rpcrdma'
sudo rpc.nfsd 0
sudo modprobe -r svcrdma
echo 'blacklist svcrdma' | sudo tee /etc/modprobe.d/blacklist-svcrdma.conf