CVE-2026-89798

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rpcrdma: arm rn_done before publishing the notification

rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before

storing the caller's callback in rn->rn_done. The xarray makes @rn

reachable to rpcrdma_remove_one(), which walks rd_xa and invokes

rn->rn_done(rn) for every registered notification. A device removal

that races a fresh registration can therefore observe @rn with

rn_done still NULL, because the notification objects are zero

allocated by their owners, and call through a NULL function pointer.

Store rn->rn_done before xa_alloc() publishes @rn. The xarray's

store-side and load-side ordering then guarantees that any CPU which

finds @rn in rd_xa also observes the armed callback.

rpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel

for a completed registration, so the early store must not survive a

failed registration. Clear rn_done again when xa_alloc() fails.

Were it left set, the fail

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References