CVE-2026-89798 Linux CVE debrief

Who should care

Linux kernel developers and administrators who need to ensure the security and stability of their systems. They should review and apply the patch, verify the Linux kernel version, and monitor system logs for potential exploitation attempts. Additionally, they should check for affected product deployments in their managed environments and assign an owner for follow-up.

Why it matters

A race condition vulnerability in the Linux kernel's rpcrdma module can lead to system crashes or instability, and potentially allow for denial of service (DoS) attacks. Linux kernel developers and administrators should review and apply the patch, verify the Linux kernel version, and monitor system logs for potential exploitation attempts.

• Potential system crashes or instability due to NULL pointer dereferences
• Possible denial of service (DoS) attacks
• Need for verification of Linux kernel version and patch application

Technical summary

The vulnerability is caused by the rpcrdma_rn_register() function inserting a notification object into the rd_xa xarray before storing the caller's callback in rn->rn_done. This can lead to a device removal racing a fresh registration, resulting in a NULL pointer dereference. The fix involves storing rn->rn_done before xa_alloc() publishes the notification object, ensuring that any CPU finding the notification object in rd_xa also observes the armed callback. This change prevents the NULL pointer dereference and ensures system stability.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the Linux kernel
• Verify the Linux kernel version and update if necessary
• Monitor system logs for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability was resolved by storing rn->rn_done before xa_alloc() publishes the notification object. The xarray's store-side and load-side ordering guarantees that any CPU which finds the notification object in rd_xa also observes the armed callback. This fix ensures that a device removal racing a fresh registration does not result in a NULL pointer dereference. To verify, defenders should review the Linux kernel version, check for the applied patch, and monitor system logs for potential exploitation attempts. The evidence is (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.