EUVD-2026-76441
GHSA-xqw2-jp99-qfhh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Race requires local/physical RDMA device removal (AV:L) and kernel-level concurrent teardown (AC:H); PR:L reflects operator-level access needed to trigger device unregistration.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which frees the cm_id. rpcrdma_rn_unregister() follows, but between those two calls the transport's sc_rn entry is still installed in the device's rd_xa. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the now-freed sc_cm_id.
Move rpcrdma_rn_unregister() before rdma_destroy_id() so the transport's notification entry is removed from the xarray before the cm_id it references is destroyed.
Also guard the sc_cm_id dereference with a NULL check: the following patches introduce paths that reach svc_rdma_free() with sc_cm_id == NULL (listener create failure, ADDR_CHANGE replacement failure).
AnalysisAI
Use-after-free in the Linux kernel's svcrdma (NFS-over-RDMA server transport) arises from incorrect teardown ordering in svc_rdma_free(): rdma_destroy_id() frees sc_cm_id while the transport's sc_rn notification entry remains registered in the device's rd_xa xarray, leaving a dangling reference that a concurrent ib_unregister_device walk can dereference via svc_rdma_xprt_done(). Exploitation requires an NFS-over-RDMA server configuration with RDMA hardware and a race between transport teardown and device unregistration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target system must be configured as an NFS-over-RDMA server with the svcrdma kernel module loaded and active RDMA hardware (InfiniBand, RoCE, or iWARP NIC) present; (2) a concurrent race between svc_rdma_free() (transport teardown, e.g., server shutdown, connection drop) and ib_unregister_device() (RDMA device removal or driver unload) must occur within a very tight kernel execution window; (3) the kernel must be running an affected version introduced at commit c4de97f7c454 and not yet patched. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) significantly overstates network reachability and privilege requirements. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Although no public exploit has been identified at time of analysis, the high severity rating warrants prioritization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today