In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notification rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before storing the caller's callback in rn->rn_done. The xarray makes @rn reachable to rpcrdma_remove_one(), which walks rd_xa and invokes rn->rn_done(rn) for every registered notification. A device removal that races a fresh registration can therefore observe @rn with rn_done still NULL, because the notification objects are zero allocated by their owners, and call through a NULL function pointer. Store rn->rn_done before xa_alloc() publishes @rn. The xarray's store-side and load-side ordering then guarantees that any CPU which finds @rn in rd_xa also observes the armed callback. rpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel for a completed registration, so the early store must not survive a failed registration. Clear rn_done again when xa_alloc() fails. Were it left set, the failed-accept cleanup path would call rpcrdma_rn_unregister() on an @rn that was never inserted, erasing an unrelated rd_xa slot and underflowing rd_kref.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing
    the notification rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before storing the caller's
    callback in rn->rn_done. The xarray makes @rn reachable to rpcrdma_remove_one(), which walks rd_xa and
    invokes rn->rn_done(rn) for every registered notification. A device removal that races a fresh
    registration can therefore observe @rn with rn_done still NULL, because the notification objects are zero
    allocated by their owners, and call through a NULL function pointer. Store rn->rn_done before xa_alloc()
    publishes @rn. The xarray's store-side and load-side ordering then guarantees that any CPU which finds @rn
    in rd_xa also observes the armed callback. rpcrdma_rn_unregister() treats a non-NULL rn_done as the
    sentinel for a completed registration, so the early store must not survive a failed registration. Clear
    rn_done again when xa_alloc() fails. Were it left set, the failed-accept cleanup path would call
    rpcrdma_rn_unregister() on an @rn that was never inserted, erasing an unrelated rd_xa slot and
    underflowing rd_kref. (CVE-2026-89798)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rpcrdma: arm rn_done before publishing the notification rpcrdma_rn_register() inserts @rn into rd_xa with     xa_alloc() before storing the caller's callback in rn->rn_done. The xarray makes @rn reachable to     rpcrdma_remove_one(), which walks rd_xa and invokes rn->rn_done(rn) for every registered notification. A     device removal that races a fresh registration can therefore observe @rn with rn_done still NULL, because     the notification objects are zero allocated by their owners, and call through a NULL function pointer.
    Store rn->rn_done before xa_alloc() publishes @rn. The xarray's store-side and load-side ordering then     guarantees that any CPU which finds @rn in rd_xa also observes the armed callback. rpcrdma_rn_unregister()     treats a non-NULL rn_done as the sentinel for a completed registration, so the early store must not     survive a failed registration. Clear rn_done again when xa_alloc() fails. Were it left set, the failed-     accept cleanup path would call rpcrdma_rn_unregister() on an @rn that was never inserted, erasing an     unrelated rd_xa slot and underflowing rd_kref. (CVE-2026-89798)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
475589	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20162.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
475589	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20162.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
475120	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Cloud Security	Google COS Security Checks	Local	medium
475120	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
346556	Linux Distros Unpatched Vulnerability : CVE-2026-89798	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-89798

medium

Tenable Plugins

medium

medium

medium

medium

high

high

high

medium