Linux Kernel svcrdma CVE-2026-89534

Exploitation requires four concurrent conditions: (1) the target must be running a Linux NFS-over-RDMA server with the svcrdma module loaded and an active RDMA listener bound to an interface; (2) the attacker must be adjacent to the RDMA fabric - physically co-located, on the same InfiniBand subnet, or on the same RoCE VLAN - as RDMA is not internet-routable; (3) an RDMA_CM_EVENT_ADDR_CHANGE event must occur on the server's RDMA interface, which happens during legitimate IP address changes or interface bounces; (4) the replacement listener cm_id allocation must fail at that precise moment, e.g., under kernel memory pressure. Exploitation is further limited by: the RDMA adjacency requirement that prevents remote internet-sourced attacks, the requirement for NFS-over-RDMA server mode (not NFS clients or standard TCP NFS servers), and the need for two failure conditions to coincide temporally.

The input CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.8, but AC:L is an overstatement: exploiting the UAF requires that an RDMA_CM_EVENT_ADDR_CHANGE event occur on the server AND that the replacement cm_id allocation fail at that moment, a coincidence that more accurately reflects AC:H. EPSS at 0.15% (5th percentile) and the absence of a KEV listing corroborate the low real-world exploitation probability. The attack vector is strictly adjacent-network (AV:A): an attacker must reside on the RDMA fabric, requiring physical co-location, InfiniBand subnet membership, or RoCE VLAN adjacency - eliminating internet-facing exposure entirely. Even a mid-sized HPC or storage infrastructure team in gniezno running NFS-over-RDMA would require an adversary already situated on the RDMA fabric before any exploitation attempt could begin. Overall real-world priority is moderate: the theoretical CIA:H/H/H impact is significant for affected environments, but the combination of adjacent-only access, specialized hardware requirements, niche deployment footprint, and failure-path race condition substantially constrains the exploitable population.

An attacker with access to the same RDMA fabric as an NFS-over-RDMA server waits for or induces an IP address change on the server's RDMA interface, triggering an RDMA_CM_EVENT_ADDR_CHANGE event. If the kernel's replacement listener cm_id allocation fails at that moment - for example under memory pressure - sc_cm_id becomes a dangling pointer to freed memory. A subsequent server shutdown or detach sequence causes the kernel to dereference this stale pointer via rdma_disconnect(), resulting in a use-after-free that can corrupt kernel memory or crash the system. No public exploit code exists at time of analysis.