CVE-2026-89798 (GCVE-0-2026-89798)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:30 – Updated: 2026-09-21 13:15
VLAI
Title
rpcrdma: arm rn_done before publishing the notification
Summary
In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notification rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before storing the caller's callback in rn->rn_done. The xarray makes @rn reachable to rpcrdma_remove_one(), which walks rd_xa and invokes rn->rn_done(rn) for every registered notification. A device removal that races a fresh registration can therefore observe @rn with rn_done still NULL, because the notification objects are zero allocated by their owners, and call through a NULL function pointer. Store rn->rn_done before xa_alloc() publishes @rn. The xarray's store-side and load-side ordering then guarantees that any CPU which finds @rn in rd_xa also observes the armed callback. rpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel for a completed registration, so the early store must not survive a failed registration. Clear rn_done again when xa_alloc() fails. Were it left set, the failed-accept cleanup path would call rpcrdma_rn_unregister() on an @rn that was never inserted, erasing an unrelated rd_xa slot and underflowing rd_kref.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7e86845a0346efc95fddaa97ce5cd6a8bda8c71c , < f9fe3cad43c42d874a388583552b39b411d886eb (git)
Affected: 7e86845a0346efc95fddaa97ce5cd6a8bda8c71c , < 3c97b8e76ca2bba9e8770571413aed694068e78e (git)
Affected: 7e86845a0346efc95fddaa97ce5cd6a8bda8c71c , < ea0408273ccf5df1fb52d9a1b9db4d31600dcb36 (git)
Affected: 7e86845a0346efc95fddaa97ce5cd6a8bda8c71c , < 5b06f706374c37375bdff9d21cc10e61df925a92 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/ib_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9fe3cad43c42d874a388583552b39b411d886eb",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "3c97b8e76ca2bba9e8770571413aed694068e78e",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "ea0408273ccf5df1fb52d9a1b9db4d31600dcb36",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "5b06f706374c37375bdff9d21cc10e61df925a92",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/ib_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpcrdma: arm rn_done before publishing the notification\n\nrpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before\nstoring the caller\u0027s callback in rn-\u003ern_done. The xarray makes @rn\nreachable to rpcrdma_remove_one(), which walks rd_xa and invokes\nrn-\u003ern_done(rn) for every registered notification. A device removal\nthat races a fresh registration can therefore observe @rn with\nrn_done still NULL, because the notification objects are zero\nallocated by their owners, and call through a NULL function pointer.\n\nStore rn-\u003ern_done before xa_alloc() publishes @rn. The xarray\u0027s\nstore-side and load-side ordering then guarantees that any CPU which\nfinds @rn in rd_xa also observes the armed callback.\n\nrpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel\nfor a completed registration, so the early store must not survive a\nfailed registration. Clear rn_done again when xa_alloc() fails.\nWere it left set, the failed-accept cleanup path would call\nrpcrdma_rn_unregister() on an @rn that was never inserted, erasing\nan unrelated rd_xa slot and underflowing rd_kref."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:15:03.259Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9fe3cad43c42d874a388583552b39b411d886eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c97b8e76ca2bba9e8770571413aed694068e78e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea0408273ccf5df1fb52d9a1b9db4d31600dcb36"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b06f706374c37375bdff9d21cc10e61df925a92"
        }
      ],
      "title": "rpcrdma: arm rn_done before publishing the notification",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89798",
    "datePublished": "2026-09-16T10:30:29.930Z",
    "dateReserved": "2026-09-11T19:38:34.767Z",
    "dateUpdated": "2026-09-21T13:15:03.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89798",
      "date": "2026-09-25",
      "epss": "0.00209",
      "percentile": "0.09815"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/ib_client.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f9fe3cad43c42d874a388583552b39b411d886eb",
                    "status": "affected",
                    "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3c97b8e76ca2bba9e8770571413aed694068e78e",
                    "status": "affected",
                    "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ea0408273ccf5df1fb52d9a1b9db4d31600dcb36",
                    "status": "affected",
                    "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b06f706374c37375bdff9d21cc10e61df925a92",
                    "status": "affected",
                    "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/ib_client.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpcrdma: arm rn_done before publishing the notification\n\nrpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before\nstoring the caller\u0027s callback in rn-\u003ern_done. The xarray makes @rn\nreachable to rpcrdma_remove_one(), which walks rd_xa and invokes\nrn-\u003ern_done(rn) for every registered notification. A device removal\nthat races a fresh registration can therefore observe @rn with\nrn_done still NULL, because the notification objects are zero\nallocated by their owners, and call through a NULL function pointer.\n\nStore rn-\u003ern_done before xa_alloc() publishes @rn. The xarray\u0027s\nstore-side and load-side ordering then guarantees that any CPU which\nfinds @rn in rd_xa also observes the armed callback.\n\nrpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel\nfor a completed registration, so the early store must not survive a\nfailed registration. Clear rn_done again when xa_alloc() fails.\nWere it left set, the failed-accept cleanup path would call\nrpcrdma_rn_unregister() on an @rn that was never inserted, erasing\nan unrelated rd_xa slot and underflowing rd_kref."
          }
        ],
        "id": "CVE-2026-89798",
        "lastModified": "2026-09-21T14:17:26.890",
        "metrics": {},
        "published": "2026-09-16T11:16:44.660",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c97b8e76ca2bba9e8770571413aed694068e78e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5b06f706374c37375bdff9d21cc10e61df925a92"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ea0408273ccf5df1fb52d9a1b9db4d31600dcb36"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f9fe3cad43c42d874a388583552b39b411d886eb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:45:16Z",
      "cve": "CVE-2026-89798",
      "id": "CVE-2026-89798",
      "initial_release_date": "2026-09-19T01:45:16Z",
      "product_status:known_affected": "41",
      "product_status:known_not_affected": "306",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89798",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89798.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.