CVE-2026-89798: rpcrdma: arm rn_done before publishing the notification
In the Linux kernel, the following vulnerability has been resolved:
rpcrdma: arm rndone before publishing the notification
rpcrdmarnregister() inserts @rn into rdxa with xaalloc() before storing the caller's callback in rn->rndone. The xarray makes @rn reachable to rpcrdmaremoveone(), which walks rdxa and invokes rn->rndone(rn) for every registered notification. A device removal that races a fresh registration can therefore observe @rn with rndone still NULL, because the notification objects are zero allocated by their owners, and call through a NULL function pointer.
Store rn->rndone before xaalloc() publishes @rn. The xarray's store-side and load-side ordering then guarantees that any CPU which finds @rn in rdxa also observes the armed callback.
rpcrdmarnunregister() treats a non-NULL rndone as the sentinel for a completed registration, so the early store must not survive a failed registration. Clear rndone again when xaalloc() fails. Were it left set, the failed-accept cleanup path would call rpcrdmarnunregister() on an @rn that was never inserted, erasing an unrelated rdxa slot and underflowing rdkref.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race?
Systems using rpcrdma are exposed when a new notification registration can race with removal of the associated device. The removal path can find a newly published notification before its callback has been initialized.
What is the effect of the race?
The device-removal path can invoke a NULL rn_done callback, resulting in a NULL function-pointer call. A failed xarray allocation also requires clearing the callback state; otherwise cleanup can remove an unrelated xarray entry and underflow the reference count.