CVE-2026-89534: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free. NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.

Засегнати продукти

• Linux Linux: d1b586e75ec619dde1af47e21a41a6b1b51874c2 преди 2a68aeb2de8ad0fef9c50e73a50622a35c6af1a8; d1b586e75ec619dde1af47e21a41a6b1b51874c2 преди 65f0f82f20334e76acaf29087a59af7b3b9699ed; d1b586e75ec619dde1af47e21a41a6b1b51874c2 преди 673e358ab7c11f8cec223c6a36a793056a67facd; d1b586e75ec619dde1af47e21a41a6b1b51874c2 преди 01500306e1d50de7ca7a2cdcdfa28ac0523eb747; 2f84d6e8b0a7093758d8da19cec111140e7b6d41; 5cd069ad1cf7fb46af31f0dbe2850868335f5272; 6.1.191 преди 6.2; 6.6.160 преди 6.7
• Linux Linux: 6.11; преди 6.11; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99265
• CVE-2026-99261
• CVE-2026-99260

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-89534
• https://nvd.nist.gov/vuln/detail/CVE-2026-89534
• https://git.kernel.org/stable/c/2a68aeb2de8ad0fef9c50e73a50622a35c6af1a8
• https://git.kernel.org/stable/c/65f0f82f20334e76acaf29087a59af7b3b9699ed
• https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd
• https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747