CVE-2026-89535

The Linux kernel's svcrdma transport, used by NFSD to serve NFS over RDMA, contains a race condition use-after-free: svc_rdma_free() calls rdma_destroy_id() (freeing the RDMA connection-manager ID) before removing the transport's notification entry from the device's xarray, so a concurrent ib_unregister_device() walk can dispatch svc_rdma_xprt_done() against the already-freed sc_cm_id. The bug is triggered when transport teardown races with RDMA device unregistration, for example during NIC hot-removal, driver unbind, or other device-teardown events. Successful exploitation yields kernel memory corruption on the affected host with high impact to confidentiality, integrity, and availability (CVSS 8.1), including potential kernel code execution or a system crash. Only systems running NFSD with the NFS-over-RDMA transport on RDMA-capable hardware (InfiniBand/RoCE) are exposed; the fix also hardens new error paths where sc_cm_id can be NULL. No public proof-of-concept exists, the issue is not in CISA's KEV catalog, and no exploitation has been observed in the wild.

What to do: Apply kernel updates from your distribution once the reordering fix (rpcrdma_rn_unregister moved before rdma_destroy_id, plus the sc_cm_id NULL check) lands in your kernel package, and reboot to load the patched kernel. If immediate patching is not possible, consider disabling NFS over RDMA on nfsservers that do not need it (e.g., do not listen on the RDMA port 20049) and restrict RDMA fabrics to trusted administrative networks. Watch for unexpected RDMA device unregistration or kernel splats referencing svc_rdma_free/svc_rdma_xprt_done as indicators of the race being hit.