---
id: CVE-2026-89798
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rpcrdma: arm rn_done before publishing the notification

  rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before
  storing the caller's callback in rn->rn_don…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rpcrdma: arm rn_done before publishing the notification

  rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before
  storing the caller's callback in rn->rn_don…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7e86845a0346efc95fddaa97ce5cd6a8bda8c71c <
    3c97b8e76ca2bba9e8770571413aed694068e78e
  - >-
    Linux >= 7e86845a0346efc95fddaa97ce5cd6a8bda8c71c <
    ea0408273ccf5df1fb52d9a1b9db4d31600dcb36
  - >-
    Linux >= 7e86845a0346efc95fddaa97ce5cd6a8bda8c71c <
    5b06f706374c37375bdff9d21cc10e61df925a92
  - Linux 6.11
published: '2026-09-16'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:26.890'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89798'
references:
  - url: 'https://git.kernel.org/stable/c/3c97b8e76ca2bba9e8770571413aed694068e78e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5b06f706374c37375bdff9d21cc10e61df925a92'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ea0408273ccf5df1fb52d9a1b9db4d31600dcb36'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f9fe3cad43c42d874a388583552b39b411d886eb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00209
epssPercentile: 0.09796
ingestedAt: '2026-09-16T10:53:54.009Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rpcrdma: arm rn_done before publishing the notification

rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before
storing the caller's callback in rn->rn_done. The xarray makes @rn
reachable to rpcrdma_remove_one(), which walks rd_xa and invokes
rn->rn_done(rn) for every registered notification. A device removal
that races a fresh registration can therefore observe @rn with
rn_done still NULL, because the notification objects are zero
allocated by their owners, and call through a NULL function pointer.

Store rn->rn_done before xa_alloc() publishes @rn. The xarray's
store-side and load-side ordering then guarantees that any CPU which
finds @rn in rd_xa also observes the armed callback.

rpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel
for a completed registration, so the early store must not survive a
failed registration. Clear rn_done again when xa_alloc() fails.
Were it left set, the failed-accept cleanup path would call
rpcrdma_rn_unregister() on an @rn that was never inserted, erasing
an unrelated rd_xa slot and underflowing rd_kref.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.