# CVE-2026-89535

## Summary

- **CVE ID:** CVE-2026-89535
- **Severity:** HIGH
- **CVSS Score:** 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 13, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id

svc_rdma_free() caches rdma->sc_cm_id->device before teardown,
then calls rdma_destroy_id(sc_cm_id) which frees the cm_id.
rpcrdma_rn_unregister() follows, but between those two calls
the transport's sc_rn entry is still installed in the device's
rd_xa. A concurrent ib_unregister_device walk can dispatch
svc_rdma_xprt_done() against the now-freed sc_cm_id.

Move rpcrdma_rn_unregister() before rdma_destroy_id() so the
transport's notification entry is removed from the xarray before
the cm_id it references is destroyed.

Also guard the sc_cm_id dereference with a NULL check: the
following patches introduce paths that reach svc_rdma_free()
with sc_cm_id == NULL (listener create failure, ADDR_CHANGE
replacement failure).

## Affected Products

- Linux — Linux (c4de97f7c45434985e5dbf2d6ccc9eca676e37fe)
- Linux — Linux (6.12)
- Linux — Linux (0)
- Linux — Linux (6.18.51)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/9f2f5d0999364c7070306cd422d8babc2621070d)
- [CNA](https://git.kernel.org/stable/c/cfca6eb3345ba4a23cf9a1153ad09bf19faabfc9)
- [CNA](https://git.kernel.org/stable/c/4488e912973773d64368828acf3b8e39d93650ae)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.51%
- **EPSS Percentile:** 42.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._