https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:05:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89534 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails</p> <p>When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()&#39;s rdma_disconnect() call -- is a use-after-free.</p> <p>NULL sc_cm_id on the failure path and guard svc_rdma_detach()&#39;s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails</p> <p>When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()&#39;s rdma_disconnect() call -- is a use-after-free.</p> <p>NULL sc_cm_id on the failure path and guard svc_rdma_detach()&#39;s rdma_disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.</p> https://vulnerability.circl.lu/vuln/cve-2026-89534