CVE-2026-92508 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ib_free_cq()
When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_free_cq(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's RDMA core subsystem contains a critical synchronization flaw within the completion queue management logic, specifically affecting the ib_free_cq function. Completion queues serve as fundamental data structures for managing asynchronous events and completions in Remote Direct Memory Access operations, making their integrity essential for system stability. The vulnerability arises from an incorrect ordering of resource deallocation steps when a completion queue is being destroyed via the netlink interface. In this specific code path, the primary synchronization mechanism relies on rdma_restrack_get to manage references to resources tracked by the RDMA restriction tracker. However, the current implementation invokes rdma_restrack_del at the very end of ib_free_cq, after vendor-specific resources associated with the completion queue have already been freed. This sequencing error creates a race condition where the completion queue remains registered in the restriction tracking system while its underlying memory and hardware contexts are no longer valid.
This architectural oversight results in a classic use-after-free vulnerability classified under CWE-416. Because the CQ is still visible through the restrack mechanism, other kernel components or user-space applications interacting with RDMA devices may attempt to access or reference this completion queue during the narrow window between resource deallocation and final removal from the tracker. If an attacker can trigger concurrent operations that exploit this timing gap, they could cause a use-after-free condition. Such conditions typically lead to memory corruption, kernel panics, or potentially arbitrary code execution if the freed memory is reallocated for malicious purposes before being fully reclaimed by the system allocator. The impact extends beyond simple denial of service, as it compromises the integrity and confidentiality guarantees provided by the RDMA subsystem.
The operational impact of this vulnerability includes potential system crashes due to invalid memory accesses when drivers or upper-layer protocols attempt to interact with a destroyed completion queue. In environments where high-performance computing relies heavily on RDMA for low-latency data transfer, such instability can disrupt critical workloads and lead to significant downtime. Furthermore, the ability to trigger use-after-free conditions in kernel space poses a severe security risk, as it provides an attack vector for privilege escalation or remote code execution depending on the specific context of memory reuse. The vulnerability is particularly dangerous because it involves complex synchronization primitives that are not immediately obvious without deep inspection of the resource tracking logic.
To mitigate this issue, the fix reorders the operations within ib_free_cq to ensure strict consistency between logical availability and physical deallocation. By moving the rdma_restrack_del call to precede the freeing of vendor-specific resources, the kernel guarantees that no new references can be acquired for a completion queue that is in the process of destruction. This change aligns with best practices for resource lifecycle management, ensuring that objects are removed from global tracking systems before their internal state becomes invalid. Security practitioners and system administrators should apply the corresponding Linux kernel patch to eliminate this race condition. Regular updates to the RDMA subsystem components are essential to maintain robustness against such synchronization flaws. The remediation effectively closes the window of opportunity for exploitation by ensuring that once resources begin to be freed, they are immediately marked as unavailable in the restriction tracker, thereby preventing any subsequent access attempts from succeeding with stale pointers.