CVE-2026-89510
Description
A flaw was found in the Linux kernel's RDMA/cxgb4 component. This vulnerability occurs when the c4iw_remove() function frees a device while its registration work (reg_work) is still pending or actively running. This timing issue can lead to the c4iw_register_device() function attempting to access memory that has already been deallocated. The primary consequence of this use-after-free vulnerability is system instability, which could potentially lead to a denial of service.
Statement
A race in the RDMA cxgb4 remove path can free ctx dev while reg_work is still pending or running. The queued registration worker can then enter c4iw_register_device and access the freed device object, which makes this a kernel use after free candidate rather than a simple warning or resource leak. The most direct impact is a local denial of service via kernel crash during device remove, driver teardown, or related error recovery paths. For the CVSS the PR:L is used for the paranoid score because some environments delegate device or network administration to a reduced capability root, container root, or service account rather than full host root. The issue is not directly network reachable from packet traffic and normally requires local control over device lifecycle or a driver state transition. Impact is at least availability loss and in the worst still defensible case may include confidentiality and integrity impact due to kernel memory corruption.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
