HIGH Introduced in 6.11
svcrdma Listener UAF
CVE-2026-89534
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free. NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.
02KernelScan AI Analysis
Risk summary
Systems running NFS over RDMA servers with bonded RDMA devices are at risk. A network address change event followed by a failed listener allocation leaves a dangling pointer that is dereferenced during server shutdown, resulting in a use-after-free that can corrupt kernel memory.
Vulnerability analysis
A use-after-free occurs in the NFS over RDMA server transport when a network address change on a bonded RDMA device triggers listener replacement. If the replacement allocation fails, the server retains a pointer to the old listener object that the RDMA Connection Manager is about to destroy. On server shutdown, the server calls disconnect on that already-freed listener, corrupting freed memory. The fix clears the stale pointer on the failure path and guards the disconnect call against NULL, allowing safe teardown. This is reachable on systems running an NFS over RDMA server with bonded RDMA devices; the trigger is a network-level address change event followed by an allocation failure, requiring no special privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.11 | 6.12.114 | 65f0f82f2033 |
| 6.18 | 6.11 | 6.18.57 | 673e358ab7c1 |
| 6.6 | 6.6.160 | 6.7 | 2a68aeb2de8a |
| 7.2 | 6.11 | 7.2.4 | 01500306e1d5 |
| mainline | 6.11 | 7.3 | — |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |