{"id":"CVE-2026-89531","title":"svcrdma: Reject connection when transport allocation fails","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject connection when transport allocation fails\n\nhandle_connect_req() returns without action when\nsvc_rdma_create_xprt() fails to allocate the new transport.…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-772"],"vendor":"Linux","product":"Linux","affected":["Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 5bf47bbea3c22c0af2293b6c393ab04d5420f7ab","Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 6e21754bbf75075f3fee1cebc79f3417364235ec","Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 3cf372cec7ab2cd8c6002bf775cc14d90ccb098b","Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 1f6a14c142fee4778c32709d1d54595c2e2b7991","Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 0944462247dcb7de7622cdaaadf5f05c52707dab","Linux 2.6.25"],"published":"2026-09-11","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:47:43.672Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89531","references":[{"url":"https://git.kernel.org/stable/c/5bf47bbea3c22c0af2293b6c393ab04d5420f7ab"},{"url":"https://git.kernel.org/stable/c/6e21754bbf75075f3fee1cebc79f3417364235ec"},{"url":"https://git.kernel.org/stable/c/3cf372cec7ab2cd8c6002bf775cc14d90ccb098b"},{"url":"https://git.kernel.org/stable/c/1f6a14c142fee4778c32709d1d54595c2e2b7991"},{"url":"https://git.kernel.org/stable/c/0944462247dcb7de7622cdaaadf5f05c52707dab"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89531.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89531"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532393"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89531"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89531"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89531.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00168,"epssPercentile":0.06163,"ingestedAt":"2026-09-14T11:11:19.886Z","slug":"CVE-2026-89531","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject connection when transport allocation fails\n\nhandle_connect_req() returns without action when\nsvc_rdma_create_xprt() fails to allocate the new transport.\nThe CM core returns 0 for CONNECT_REQUEST events, so it does\nnot destroy the new rdma_cm_id. Each allocation failure under\nmemory pressure leaks one rdma_cm_id, and a remote peer driving\nconnection attempts can amplify this.\n\nReject the connection by returning a non-zero status from the\nCM event handler, which tells the CM core to destroy the\norphaned cm_id.\n\n## Affected\n\n- `Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 5bf47bbea3c22c0af2293b6c393ab04d5420f7ab`\n- `Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 6e21754bbf75075f3fee1cebc79f3417364235ec`\n- `Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 3cf372cec7ab2cd8c6002bf775cc14d90ccb098b`\n- `Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 1f6a14c142fee4778c32709d1d54595c2e2b7991`\n- `Linux >= 377f9b2f4529e0ac702fd7b91e216afd0adc959e < 0944462247dcb7de7622cdaaadf5f05c52707dab`\n- `Linux 2.6.25`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89531.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":216235,"id":"CVE-2026-89531","ts":1791274045756,"field":"cvss","old":"7","new":"5.5"},{"seq":216234,"id":"CVE-2026-89531","ts":1791274045756,"field":"severity","old":"high","new":"medium"},{"seq":206921,"id":"CVE-2026-89531","ts":1789749702895,"field":"cvss","old":"5.9","new":"7"},{"seq":206920,"id":"CVE-2026-89531","ts":1789749702895,"field":"severity","old":"medium","new":"high"},{"seq":203968,"id":"CVE-2026-89531","ts":1789490230844,"field":"cvss","old":null,"new":"5.9"},{"seq":203967,"id":"CVE-2026-89531","ts":1789490230844,"field":"severity","old":"none","new":"medium"},{"seq":147283,"id":"CVE-2026-89531","ts":1789270206857,"field":"cvss","old":null,"new":"5.9"},{"seq":147282,"id":"CVE-2026-89531","ts":1789270206857,"field":"severity","old":"none","new":"medium"},{"seq":109028,"id":"CVE-2026-89531","ts":1789183730021,"field":"cvss","old":null,"new":"5.9"},{"seq":109027,"id":"CVE-2026-89531","ts":1789183730021,"field":"severity","old":"none","new":"medium"}]}