CVE-2026-89534 svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
A use-after-free in the Linux kernel's svcrdma module allows attackers to cause a denial of service or potentially execute code when an RDMA address change fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89534?
CVE-2026-89534 is a high-severity use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free.
NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.
Which versions are affected by CVE-2026-89534?
How do I fix CVE-2026-89534?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89534 being exploited?
There is no known exploitation of CVE-2026-89534 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89534, DEBIAN-CVE-2026-89534, GHSA-9cv8-xv6f-2jmx, UBUNTU-CVE-2026-89534.