Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-89510

RDMA/cxgb4: Cancel reg_work before freeing device on remove

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device. Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case. This issue was found by an in-house static analysis tool.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 · fixed in e6e79e7be87c5ea92728060a3d7fb56890a91e45; From 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 · fixed in 672ee1981db10569ec96030bddb322f18382ec04; From 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 · fixed in 4681e731db07769846901cfabdd3e53f765eb9d3; From 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 · fixed in 3265d558dfafab8f12f5fba06ebbf15cae9f3225; From 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 · fixed in fe9c591026c576d8b1f72aab5e4cd67350530763; From 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 · fixed in 85f438382a865a4dc4c50e6b884310bb2b60fc4d; From 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 · fixed in 320e5258a53af0abc5abd9eb01519a48bab2dee8; From 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 · fixed in a7100601aa1a39f799a566acce10db20eaf4b7f2

  • Linux Linux

    4.15

  • KernelLinux

    From 4.15.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4

References 8

git.kernel.org