CVE-2026-89509

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ionic: Embed counter driver data in rdma counter allocation

Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdma counter using rdma zalloc drv obj()") requires drivers implementing counter ops to embed struct rdma counter in a driver-specific struct, register its size via INIT RDMA OBJ SIZE, and provide a counter init callback.

The ionic driver was merged without this adaptation, causing a NULL pointer dereference in alloc and bind() since rdma zalloc drv obj() allocates zero bytes when size rdma counter is unset.

Consolidate struct ionic counter into a new struct ionic rdma counter that embeds struct rdma counter, replace the xarray with a lightweight ida for ID allocation, and add the required counter init and INIT RDMA OBJ SIZE declarations.