CVE-2026-89510
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Cancel reg_work before freeing device on remove
c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device.
Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case.
This issue was found by an in-house static analysis tool.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 < fe9c591026c576d8b1f72aab5e4cd67350530763 | affected |
| Linux | Linux | 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 < 85f438382a865a4dc4c50e6b884310bb2b60fc4d | affected |
| Linux | Linux | 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 < 320e5258a53af0abc5abd9eb01519a48bab2dee8 | affected |
| Linux | Linux | 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5 < a7100601aa1a39f799a566acce10db20eaf4b7f2 | affected |
| Linux | Linux | 4.15 | affected |
| Linux | Linux | 0 < 4.15 | unaffected |
| Linux | Linux | 6.12.109 <= 6.12.* | unaffected |
| Linux | Linux | 6.18.50 <= 6.18.* | unaffected |
| Linux | Linux | 7.2.4 <= 7.2.* | unaffected |
| Linux | Linux | 7.3-rc1 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/fe9c591026c576d8b1f72aab5e4cd67350530763
- https://git.kernel.org/stable/c/85f438382a865a4dc4c50e6b884310bb2b60fc4d
- https://git.kernel.org/stable/c/320e5258a53af0abc5abd9eb01519a48bab2dee8
- https://git.kernel.org/stable/c/a7100601aa1a39f799a566acce10db20eaf4b7f2
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.