Strix
64.5K

CVE-2026-89510

HIGHCVSS 7.8/10EPSS 0.18%

Last modified

CVE-2026-89510 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device. Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case. This issue was found by an in-house static analysis tool.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device. Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case. This issue was found by an in-house static analysis tool.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.18%

7.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5, < e6e79e7be87c5ea92728060a3d7fb56890a91e45; >= 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5, < 672ee1981db10569ec96030bddb322f18382ec04; >= 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5, < 4681e731db07769846901cfabdd3e53f765eb9d3; >= 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5, < 3265d558dfafab8f12f5fba06ebbf15cae9f3225; >= 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5, < fe9c591026c576d8b1f72aab5e4cd67350530763; >= 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5, < 85f438382a865a4dc4c50e6b884310bb2b60fc4d; >= 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5, < 320e5258a53af0abc5abd9eb01519a48bab2dee8; >= 1c8f1da5d851b92aeb81dbbb9ebd516f6e2588f5, < a7100601aa1a39f799a566acce10db20eaf4b7f2
LinuxLinux4.15

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89510?
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device. Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case. This issue was found by an in-house static analysis tool.
How severe is CVE-2026-89510?
CVE-2026-89510 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2026-89510?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89510?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST