{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "d1b586e75ec619dde1af47e21a41a6b1b51874c2"
            },
            {
              "fixed": "673e358ab7c11f8cec223c6a36a793056a67facd"
            },
            {
              "fixed": "01500306e1d50de7ca7a2cdcdfa28ac0523eb747"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.11.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89534.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails\n\nWhen svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE,\nit creates a replacement listener cm_id and returns 1, telling\nthe CM core to destroy the old one. If the replacement allocation\nfails, sc_cm_id still points at the old cm_id that the CM core is\nabout to destroy. Any subsequent dereference of sc_cm_id --\nsuch as svc_rdma_detach()'s rdma_disconnect() call -- is a\nuse-after-free.\n\nNULL sc_cm_id on the failure path and guard svc_rdma_detach()'s\nrdma_disconnect() call against NULL so that the listener can\nbe torn down safely when the server shuts down.",
  "id": "CVE-2026-89534",
  "modified": "2026-09-15T03:30:33.707075940Z",
  "published": "2026-09-11T19:44:12.987Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89534.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89534"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails"
}