CVE-2026-89535

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Reorder rpcrdma rn unregister before rdma destroy id

svc rdma free() caches rdma->sc cm id->device before teardown, then calls rdma destroy id(sc cm id) which frees the cm id. rpcrdma rn unregister() follows, but between those two calls the transport's sc rn entry is still installed in the device's rd xa. A concurrent ib unregister device walk can dispatch svc rdma xprt done() against the now-freed sc cm id.

Move rpcrdma rn unregister() before rdma destroy id() so the transport's notification entry is removed from the xarray before the cm id it references is destroyed.

Also guard the sc cm id dereference with a NULL check: the following patches introduce paths that reach svc rdma free() with sc cm id == NULL (listener create failure, ADDR CHANGE replacement failure).