CVE-2026-89534

The Linux kernel's svcrdma subsystem, which serves NFS over RDMA, mishandles the RDMA_CM_EVENT_ADDR_CHANGE event in svc_rdma_listen_handler(): if allocation of the replacement listener cm_id fails, the sc_cm_id pointer is left dangling at the old cm_id that the Connection Manager core is about to destroy. Any later dereference of that pointer -- notably svc_rdma_detach()'s rdma_disconnect() call during server shutdown -- becomes a use-after-free. An attacker on the same network segment (the CVSS attack vector is adjacent network) who can induce an address-change event while the replacement allocation is failing (e.g., under memory pressure) could trigger the flaw, potentially crashing the kernel or achieving memory corruption with high confidentiality, integrity, and availability impact. Only systems running an NFS server with the RDMA transport enabled (requiring InfiniBand, RoCE, or iWARP hardware) are affected; no public proof of concept or exploitation in the wild is known.

What to do: Apply kernel updates containing the svcrdma fixing commit (which NULLs sc_cm_id on the failure path and guards svc_rdma_detach()'s rdma_disconnect() call) as soon as your distribution ships them. If you cannot patch immediately and do not need NFS over RDMA, disable the RDMA transport on NFS servers or block/unload the relevant RDMA/InfiniBand modules. Check HPC and storage-cluster nodes running NFS servers with RDMA enabled, and watch for kernel crashes or oopses in svc_rdma code paths as potential indicators.