CVE-2026-89798: Linux Kernel RPCRDMA Race Condition Flaw

CVE-2026-89798 Overview

CVE-2026-89798 is a race condition vulnerability in the Linux kernel's rpcrdma (Remote Procedure Call over Remote Direct Memory Access) subsystem. The flaw exists in rpcrdma_rn_register(), which publishes a notification object to the rd_xa xarray before storing the caller's callback pointer in rn->rn_done. A concurrent device removal that walks rd_xa through rpcrdma_remove_one() can observe the notification object with rn_done still NULL and invoke a NULL function pointer. The issue also affects the failure path, where a stale rn_done value can cause rpcrdma_rn_unregister() to erase an unrelated rd_xa slot and underflow rd_kref.

Critical Impact
A device removal racing with a fresh RDMA notification registration can trigger a NULL function pointer call in kernel context, leading to denial of service or memory corruption on systems using RPC-over-RDMA transports.

Affected Products

Linux kernel net/sunrpc/xprtrdma (rpcrdma) subsystem
Systems using NFS or other RPC services over RDMA transports
Kernel builds prior to the commits referenced in the stable tree fixes

Discovery Timeline

2026-09-16 - CVE CVE-2026-89798 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89798

Vulnerability Analysis

The rpcrdma subsystem allows callers to register notification objects that fire when an RDMA device is removed. The rpcrdma_rn_register() function inserts the notification object @rn into the rd_xa xarray using xa_alloc() and only afterward stores the caller-supplied callback in rn->rn_done. Because notification objects are zero-allocated by their owners, rn_done remains NULL during the window between the xa_alloc() call and the callback assignment.

During this window, rpcrdma_remove_one() can walk rd_xa and invoke rn->rn_done(rn) for every registered notification. If a device removal races a fresh registration, the remove path dereferences a NULL function pointer in kernel context. The fix reorders the operations so rn->rn_done is stored before xa_alloc() publishes @rn. The xarray's store-side and load-side ordering then guarantees any CPU that finds @rn in rd_xa also observes the armed callback.

Root Cause

The root cause is a publication-before-initialization ordering bug [race condition] combined with a secondary state-tracking issue. rpcrdma_rn_unregister() treats a non-NULLrn_done as the sentinel for a completed registration. If xa_alloc() fails after the early store is added, the sentinel would falsely indicate a completed registration, and the failed-accept cleanup path would call rpcrdma_rn_unregister() on an @rn that was never inserted. This would erase an unrelated rd_xa slot and underflow rd_kref.

Attack Vector

Exploitation requires the ability to trigger concurrent RDMA notification registrations and RDMA device removal events on a system with rpcrdma in use. The race window is small but reachable in normal operation on hosts using NFS-over-RDMA with hot-pluggable or removable RDMA hardware. Successful exploitation results in a kernel NULL pointer dereference or corruption of the rd_xa xarray, causing denial of service or potentially exploitable memory state.

No public proof-of-concept code is available. See the Linux Kernel Commit 3c97b8e, Linux Kernel Commit 5b06f70, and Linux Kernel Commit ea04082 for the upstream fixes.

Detection Methods for CVE-2026-89798

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing rpcrdma_remove_one or NULL function pointer dereferences in the xprtrdma module
Unexpected kernel warnings referencing rd_xa, rd_kref underflow, or xarray inconsistencies
Unexplained NFS-over-RDMA transport failures coinciding with RDMA device hotplug or removal events

Detection Strategies

Monitor kernel logs for stack traces containing rpcrdma_rn_register, rpcrdma_rn_unregister, or rpcrdma_remove_one symbols
Correlate kernel crash telemetry with RDMA device state changes captured via udev or ibv_devinfo
Track kernel package versions across the fleet to identify hosts running builds that predate the referenced stable-tree commits

Monitoring Recommendations

Ingest dmesg and journald kernel messages into a centralized log platform for pattern-based alerting on rpcrdma symbols
Alert on repeated kernel crashes on the same host, especially where NFS-over-RDMA is deployed
Track RDMA device hotplug events on servers that expose NFS-over-RDMA to correlate with kernel instability

How to Mitigate CVE-2026-89798

Immediate Actions Required

Inventory all Linux hosts using NFS-over-RDMA or other RPC-over-RDMA transports and identify kernels that lack the referenced stable-tree commits
Schedule kernel updates to a version containing the fix from commits 3c97b8e, 5b06f70, and ea04082
On systems where patching is delayed, avoid RDMA device hot-remove operations and minimize concurrent RPC-over-RDMA client registrations

Patch Information

The upstream Linux kernel fix reorders rpcrdma_rn_register() to store rn->rn_done before publishing @rn via xa_alloc(), and clears rn_done again if xa_alloc() fails so rpcrdma_rn_unregister() does not act on a never-inserted object. Apply distribution-supplied kernel updates that include Linux Kernel Commit 3c97b8e, Linux Kernel Commit 5b06f70, and Linux Kernel Commit ea04082.

Workarounds

Disable NFS-over-RDMA and fall back to TCP transports until the kernel is patched
Unload the xprtrdma and rpcrdma modules on hosts that do not require RDMA-backed RPC
Prevent unprivileged users from triggering RDMA device removal by restricting access to hotplug interfaces under /sys/bus/pci

bash

# Configuration example: switch NFS clients to TCP until patched
# /etc/nfsmount.conf
[ Server "nfs-server.example.com" ]
 Protocol=tcp

# Blacklist rpcrdma if RDMA transports are not required
echo 'blacklist rpcrdma' | sudo tee /etc/modprobe.d/blacklist-rpcrdma.conf
echo 'blacklist xprtrdma' | sudo tee -a /etc/modprobe.d/blacklist-rpcrdma.conf
sudo update-initramfs -u