CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Cancel regwork before freeing device on remove
c4iwuldstatechange() queues regwork to register the RDMA device. c4iwremove() can free ctx->dev while this work is pending or running, leaving c4iwregisterdevice() accessing the freed device.
Cancel regwork before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case.
This issue was found by an in-house static analysis tool.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The RDMA/cxgb4 driver's deferred registration work, reg_work, must still be pending or running when the device removal path frees ctx->dev. The resulting race allows c4iw_register_device() to access the freed device.
What is the likely impact of a successful trigger?
The described impact is a use-after-free condition in the Linux kernel's RDMA/cxgb4 driver. The provided data does not specify a privilege boundary, remote attack vector, or further consequences.
What should be changed to mitigate the issue?
Ensure reg_work is cancelled before removing or freeing the device. The removal path must also avoid unregistering or deallocating ctx->dev again if failed registration work has already torn it down.