HIGH Introduced in 6.12
svcrdma CmId UAF
CVE-2026-89535
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which frees the cm_id. rpcrdma_rn_unregister() follows, but between those two calls the transport's sc_rn entry is still installed in the device's rd_xa. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the now-freed sc_cm_id. Move rpcrdma_rn_unregister() before rdma_destroy_id() so the transport's notification entry is removed from the xarray before the cm_id it references is destroyed. Also guard the sc_cm_id dereference with a NULL check: the following patches introduce paths that reach svc_rdma_free() with sc_cm_id == NULL (listener create failure, ADDR_CHANGE replacement failure).
02KernelScan AI Analysis
Risk summary
A race condition in the NFS/RDMA server transport teardown path allows a concurrent device removal to access a freed connection-manager ID, leading to use-after-free memory corruption. An attacker who can trigger RDMA device unregistration while the NFS/RDMA service is tearing down a transport could exploit this for kernel memory corruption, potentially escalating privileges or causing a denial of service.
Vulnerability analysis
During shutdown of an NFS/RDMA transport, the server frees an RDMA identifier before removing the transport's registration from the device's tracking list. If a concurrent device-removal operation runs in that window, it can call a handler that dereferences the already-freed identifier, corrupting kernel memory. The fix reorders shutdown so the registration is removed before the identifier is destroyed, and adds a check for cases where no identifier was created. The vulnerable path is in the kernel NFS/RDMA server and is triggered by concurrent RDMA device removal, which requires local access with privileges sufficient to initiate device teardown or unbind an RDMA device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12 | 6.12.111 | fcd4a752ac84 |
| 6.18 | 6.12 | 6.18.51 | 9f2f5d099936 |
| 7.2 | 6.12 | 7.2.4 | cfca6eb3345b |
| mainline | 6.12 | 7.3 | 4488e9129737 |
| cip/6.12 | 6.12 | 6.12.111-cip32 | fcd4a752ac84 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |