CVE-2026-92507 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_dealloc_pd_user(), which is too late, since by that point vendor-specific resources associated with the PD might already be freed. This can leave a short window where the PD remains accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_begin_del() call to the start of ib_dealloc_pd_user(), ensuring that the PD is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a PD that is in the process of destruction.
In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel contains a critical synchronization flaw within the RDMA core subsystem that can lead to a use-after-free vulnerability in the ib_dealloc_pd_user function. This issue arises specifically when Protection Domains are accessed via the netlink interface, where the rdma_restrack_get mechanism serves as the primary synchronization primitive for resource tracking. The root cause lies in the timing of resource deallocation relative to reference counting and removal from the restriction tracker. Currently, the system invokes rdma_restrack_del at the end of the ib_dealloc_pd_user routine. This late invocation creates a dangerous window where vendor-specific resources associated with the Protection Domain may already be freed by internal cleanup processes, yet the domain remains registered in the restrack subsystem. Consequently, if another thread or context attempts to access this Protection Domain through the netlink path during this interval, it may retrieve a reference to memory that has already been released back to the system allocator, resulting in undefined behavior and potential exploitation.
This vulnerability aligns with CWE-416, Use After Free, as the kernel allows operations on an object after its lifetime has ended due to improper lifecycle management. From a threat modeling perspective, this flaw can be mapped to ATT&CK technique T1059, Command and Scripting Interpreter, if exploited for arbitrary code execution via kernel memory corruption, or more broadly to privilege escalation vectors where the attacker leverages the use-after-free condition to corrupt kernel data structures such as function pointers or object headers. The impact is severe because it affects core networking infrastructure components that are frequently accessed in high-throughput environments typical of modern cloud and HPC deployments. An attacker with local access could potentially trigger this race condition by rapidly creating and destroying Protection Domains while simultaneously querying them via netlink, thereby increasing the probability of hitting the narrow timing window where the resource is logically freed but structurally still referenced.
The resolution involves a precise adjustment to the order of operations within the ib_dealloc_pd_user function. By moving the rdma_restrack_begin_del call to the very beginning of the deallocation routine, the system ensures that the Protection Domain is immediately removed from the restriction tracker before any internal resources are released. This change guarantees that no new users can acquire references to a Protection Domain that is in the process of being destroyed. Furthermore, this fix preserves the intended inverted order between creation and destruction routines. During normal operation, resources are added to the restrack at the end of successful creation; therefore, they must be removed from the restrack as the first step during destruction. This consistency ensures predictable lifecycle management and eliminates the race condition that previously allowed stale references to persist after resource invalidation.
To mitigate this vulnerability in environments where kernel updates may not be immediately available, administrators should monitor for unusual patterns of RDMA resource creation and deletion combined with netlink queries. Implementing strict access controls on netlink sockets can reduce the attack surface by limiting which users or processes can interact with these interfaces. Additionally, enabling kernel hardening features such as KASAN (Kernel Address Sanitizer) in development environments can help detect similar use-after-free conditions before they reach production systems. The primary mitigation remains applying the vendor-provided security patch that updates the RDMA core subsystem to enforce correct resource tracking order. Organizations relying on high-performance computing or remote direct memory access capabilities must prioritize this update to maintain system integrity and prevent potential privilege escalation attacks stemming from kernel memory corruption.