CVE-2026-89510

A use-after-free race condition exists in the Linux kernel's RDMA/cxgb4 driver, which supports RDMA (iWARP) functionality on Chelsio T4/T5-class network adapters. The driver queues a 'reg_work' work item to register the RDMA device, but during device removal c4iw_remove() can free the device structure (ctx->dev) while that work is still pending or running, causing c4iw_register_device() to access freed memory. The flaw is triggered when adapter removal (hot-unplug or driver unbind/unload) races with the registration path, so an attacker needs local access with low privileges on a system running the affected hardware. Successful exploitation could crash the kernel or, per the CVSS 7.8 rating, achieve memory corruption with high impact to confidentiality, integrity, and availability. The issue was found by in-house static analysis, and there is no public proof of concept or evidence of exploitation in the wild.

What to do: Apply your distribution's kernel update once the fix (cancelling reg_work before freeing the device in c4iw_remove()) is available, and confirm RDMA nodes are running the patched kernel. As an interim measure, restrict local privileged access and avoid hot-unplugging or unbinding cxgb4 adapters while device registration may be in flight. Systems without Chelsio RDMA hardware are not exposed to this code path.