Executive brief
The Linux kernel's svcrdma (RDMA transport for NFS/RPC services) component has a use-after-free vulnerability in how it cleans up device connections during shutdown. When an InfiniBand device is removed, concurrent operations can access memory that has already been freed, potentially causing system crashes or enabling local code execution on systems running NFS services over RDMA.
Technical details
The vulnerability is a use-after-free in the svc_rdma_free() function within the svcrdma RDMA transport layer. The root cause is an incorrect order of cleanup operations: the code was calling rdma_destroy_id() to free a connection manager ID before unregistering the transport's device notification entry (rpcrdma_rn_unregister). Between these two calls, the transport's sc_rn entry remains installed in the device's xarray. A concurrent InfiniBand device unregister walk can dispatch svc_rdma_xprt_done() against the now-freed connection manager ID, resulting in a use-after-free. The fix reorders the operations to unregister the notification entry before destroying the connection manager ID, and adds a NULL check to guard against listener creation or address change failure paths. This vulnerability affects systems running NFS services over RDMA and requires local access to trigger device removal or address change events.
Affected products
- Linux Linux kernel 5.13 and later (introduced in c4de97f7c454)
Timeline
- 2026-09-11: disclosed: CVE-2026-89535 published