CVE-2026-89798: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-rf2c-8wjw-q46f
Share
Published
Advisory Summary

CVE-2026-89798 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89798 at a Glance

CVE Identifier CVE-2026-89798
GHSA Identifier GHSA-rf2c-8wjw-q46f
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-89798

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89798, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notification rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before storing the caller's callback in rn->rn_done. The xarray makes @rn reachable to rpcrdma_remove_one(), which walks rd_xa and invokes rn->rn_done(rn) for every registered notification. A device removal that races a fresh registration can therefore observe @rn with rn_done still NULL, because the notification objects are zero allocated by their owners, and call through a NULL function pointer. Store rn->rn_done before xa_alloc() publishes @rn. The xarray's store-side and load-side ordering then guarantees that any CPU which finds @rn in rd_xa also observes the armed callback. rpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel for a completed registration, so the early store must not survive a failed registration. Clear rn_done again when xa_alloc() fails. Were it left set, the failed-accept cleanup path would call rpcrdma_rn_unregister() on an @rn that was never inserted, erasing an unrelated rd_xa slot and underflowing rd_kref.

References

NVD — CVE-2026-89798 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89798
git.kernel.org/stable/c/3c97b8e76c... WEB
https://git.kernel.org/stable/c/3c97b8e76ca2bba9e8770571413aed694068e78e
git.kernel.org/stable/c/5b06f70637... WEB
https://git.kernel.org/stable/c/5b06f706374c37375bdff9d21cc10e61df925a92
git.kernel.org/stable/c/ea0408273c... WEB
https://git.kernel.org/stable/c/ea0408273ccf5df1fb52d9a1b9db4d31600dcb36
git.kernel.org/stable/c/f9fe3cad43... WEB
https://git.kernel.org/stable/c/f9fe3cad43c42d874a388583552b39b411d886eb

Frequently Asked Questions

What is CVE-2026-89798?
CVE-2026-89798 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89798?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-89798?
CVE-2026-89798 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89798?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rf2c-8wjw-q46f",
  "modified" : "2026-09-21T15:31:42Z",
  "published" : "2026-09-16T12:30:36Z",
  "aliases" : [ "CVE-2026-89798" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nrpcrdma: arm rn_done before publishing the notification\n\nrpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before\nstoring the caller's callback in rn->rn_done. The xarray makes @rn\nreachable to rpcrdma_remove_one(), which walks rd_xa and invokes\nrn->rn_done(rn) for every registered notification. A device removal\nthat races a fresh registration can therefore observe @rn with\nrn_done still NULL, because the notification objects are zero\nallocated by their owners, and call through a NULL function pointer.\n\nStore rn->rn_done before xa_alloc() publishes @rn. The xarray's\nstore-side and load-side ordering then guarantees that any CPU which\nfinds @rn in rd_xa also observes the armed callback.\n\nrpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel\nfor a completed registration, so the early store must not survive a\nfailed registration. Clear rn_done again when xa_alloc() fails.\nWere it left set, the failed-accept cleanup path would call\nrpcrdma_rn_unregister() on an @rn that was never inserted, erasing\nan unrelated rd_xa slot and underflowing rd_kref.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89798"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3c97b8e76ca2bba9e8770571413aed694068e78e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5b06f706374c37375bdff9d21cc10e61df925a92"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ea0408273ccf5df1fb52d9a1b9db4d31600dcb36"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f9fe3cad43c42d874a388583552b39b411d886eb"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-16T11:16:44Z"
  }
}