UBUNTU-CVE-2026-89534: Use After Free
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sccmid when ADDRCHANGE replacement fails When svcrdmalistenhandler() handles RDMACMEVENTADDRCHANGE, it creates a replacement listener cmid and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sccmid still points at the old cmid that the CM core is about to destroy. Any subsequent dereference of sccmid -- such as svcrdmadetach()'s rdmadisconnect() call -- is a use-after-free. NULL sccmid on the failure path and guard svcrdmadetach()'s rdmadisconnect() call against NULL so that the listener can be torn down safely when the server shuts down.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In svc_rdma_listen_handler(), set sc_cm_id to NULL when the ADDR_CHANGE replacement cm_id allocation fails, and guard svc_rdma_detach()'s rdma_disconnect() call against NULL before tearing down the listener.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The affected packages listed are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates no privileges are required and no user interaction is required. The attack vector is adjacent network.
What runtime condition leads to the use-after-free?
The condition occurs when the RDMA service listener handles an RDMA_CM_EVENT_ADDR_CHANGE and creation of its replacement listener fails. The old connection-manager ID is then destroyed while the listener state can still retain a pointer to it, which may later be dereferenced during teardown.
What does the fix need to do?
The fix clears sc_cm_id when replacement listener allocation fails and avoids calling rdma_disconnect() during svc_rdma_detach() when sc_cm_id is NULL. This permits safe listener teardown after the failed replacement.