FKIE_CVE-2026-89798

Vulnerability from fkie_nvd - Published: 2026-09-16 11:16 - Updated: 2026-09-21 14:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notification rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before storing the caller's callback in rn->rn_done. The xarray makes @rn reachable to rpcrdma_remove_one(), which walks rd_xa and invokes rn->rn_done(rn) for every registered notification. A device removal that races a fresh registration can therefore observe @rn with rn_done still NULL, because the notification objects are zero allocated by their owners, and call through a NULL function pointer. Store rn->rn_done before xa_alloc() publishes @rn. The xarray's store-side and load-side ordering then guarantees that any CPU which finds @rn in rd_xa also observes the armed callback. rpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel for a completed registration, so the early store must not survive a failed registration. Clear rn_done again when xa_alloc() fails. Were it left set, the failed-accept cleanup path would call rpcrdma_rn_unregister() on an @rn that was never inserted, erasing an unrelated rd_xa slot and underflowing rd_kref.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3c97b8e76ca2bba9e8770571413aed694068e78e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5b06f706374c37375bdff9d21cc10e61df925a92
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ea0408273ccf5df1fb52d9a1b9db4d31600dcb36
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f9fe3cad43c42d874a388583552b39b411d886eb
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/ib_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9fe3cad43c42d874a388583552b39b411d886eb",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "3c97b8e76ca2bba9e8770571413aed694068e78e",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "ea0408273ccf5df1fb52d9a1b9db4d31600dcb36",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "5b06f706374c37375bdff9d21cc10e61df925a92",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/ib_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpcrdma: arm rn_done before publishing the notification\n\nrpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before\nstoring the caller\u0027s callback in rn-\u003ern_done. The xarray makes @rn\nreachable to rpcrdma_remove_one(), which walks rd_xa and invokes\nrn-\u003ern_done(rn) for every registered notification. A device removal\nthat races a fresh registration can therefore observe @rn with\nrn_done still NULL, because the notification objects are zero\nallocated by their owners, and call through a NULL function pointer.\n\nStore rn-\u003ern_done before xa_alloc() publishes @rn. The xarray\u0027s\nstore-side and load-side ordering then guarantees that any CPU which\nfinds @rn in rd_xa also observes the armed callback.\n\nrpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel\nfor a completed registration, so the early store must not survive a\nfailed registration. Clear rn_done again when xa_alloc() fails.\nWere it left set, the failed-accept cleanup path would call\nrpcrdma_rn_unregister() on an @rn that was never inserted, erasing\nan unrelated rd_xa slot and underflowing rd_kref."
    }
  ],
  "id": "CVE-2026-89798",
  "lastModified": "2026-09-21T14:17:26.890",
  "metrics": {},
  "published": "2026-09-16T11:16:44.660",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3c97b8e76ca2bba9e8770571413aed694068e78e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5b06f706374c37375bdff9d21cc10e61df925a92"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ea0408273ccf5df1fb52d9a1b9db4d31600dcb36"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f9fe3cad43c42d874a388583552b39b411d886eb"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.