CVE-2026-89534

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Clear sc cm id when ADDR CHANGE replacement fails

When svc rdma listen handler() handles RDMA CM EVENT ADDR CHANGE, it creates a replacement listener cm id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc cm id still points at the old cm id that the CM core is about to destroy. Any subsequent dereference of sc cm id -- such as svc rdma detach()'s rdma disconnect() call -- is a use-after-free.

NULL sc cm id on the failure path and guard svc rdma detach()'s rdma disconnect() call against NULL so that the listener can be torn down safely when the server shuts down.