EUVD-2026-76440
GHSA-9cv8-xv6f-2jmx
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A for RDMA fabric adjacency requirement; AC:H because triggering the UAF requires coincident ADDR_CHANGE event and kernel allocation failure on the error path.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free.
NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.
AnalysisAI
Use-after-free in the Linux kernel NFS-over-RDMA server (svcrdma) allows an adjacent-network attacker to trigger kernel memory corruption when an RDMA_CM_EVENT_ADDR_CHANGE event coincides with a replacement listener cm_id allocation failure, leaving sc_cm_id pointing to a destroyed object. Subsequent kernel operations that dereference sc_cm_id - most immediately rdma_disconnect() in svc_rdma_detach() - read or write freed kernel memory, with potential impacts on confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires four concurrent conditions: (1) the target must be running a Linux NFS-over-RDMA server with the svcrdma module loaded and an active RDMA listener bound to an interface; (2) the attacker must be adjacent to the RDMA fabric - physically co-located, on the same InfiniBand subnet, or on the same RoCE VLAN - as RDMA is not internet-routable; (3) an RDMA_CM_EVENT_ADDR_CHANGE event must occur on the server's RDMA interface, which happens during legitimate IP address changes or interface bounces; (4) the replacement listener cm_id allocation must fail at that precise moment, e.g., under kernel memory pressure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.8, but AC:L is an overstatement: exploiting the UAF requires that an RDMA_CM_EVENT_ADDR_CHANGE event occur on the server AND that the replacement cm_id allocation fail at that moment, a coincidence that more accurately reflects AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel stable patches at https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd and https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747, or upgrade to Linux 7.2.4 or 7.3-rc1 which contain the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether NFS-over-RDMA server functionality is enabled in your Linux infrastructure by checking kernel configuration and active RDMA services; if not deployed, close the action item. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today