CVE-2026-92509 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in counter_release()
When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of counter_release(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's RDMA core subsystem contains a synchronization flaw within the counter_release function that can lead to a use-after-free vulnerability. This issue arises specifically when counters are accessed via the netlink interface, where the primary mechanism for managing resource lifecycles is rdma_restrack_get. The root cause lies in the ordering of operations during the cleanup phase of a counter object. Specifically, the call to rdma_restrack_del(), which removes the counter from the internal tracking structure, was positioned at the very end of the release function. This placement creates a critical timing window where vendor-specific resources associated with the counter may be freed while the counter remains registered in the restrack system. Consequently, if another thread or process attempts to access this counter through the netlink path during this interval, it will interact with memory that has already been deallocated, resulting in undefined behavior and potential kernel instability.
This vulnerability is classified under CWE-416, which describes use after free errors where a pointer continues to be used after its memory has been freed. In the context of operating system kernels, such flaws are particularly dangerous as they can lead to privilege escalation or denial of service conditions depending on how the corrupted data is interpreted by subsequent operations. The ATT&CK framework categorizes this type of exploitation under techniques involving invalid resource access, where an attacker leverages improper synchronization to interact with resources in a state that violates expected lifecycle constraints. The lack of proper atomicity between removing the object from tracking structures and freeing its underlying memory allows for race conditions that can be triggered by concurrent netlink requests targeting the same counter identifier.
The operational impact of this vulnerability includes potential kernel panics, data corruption, or arbitrary code execution if an attacker can precisely time their access to coincide with the window where the counter is accessible via restrack but its backing storage has been released. This risk is amplified in high-throughput RDMA environments where multiple processes may concurrently query resource statistics. The fix addresses this by reordering the operations within counter_release so that rdma_restrack_del() is invoked before any vendor-specific resources are freed. By ensuring that the counter is unregistered from the tracking system prior to memory deallocation, the kernel guarantees that no new references can be established to a counter undergoing destruction. This change eliminates the race condition and ensures strict adherence to resource lifecycle management protocols within the RDMA subsystem.
To mitigate this vulnerability in environments where patching may not be immediately feasible, administrators should monitor for unusual kernel oops messages or system crashes associated with RDMA operations. Limiting access to netlink interfaces used by RDMA components can reduce the attack surface, although complete mitigation requires applying the upstream kernel fix that corrects the ordering of resource deallocation and tracking removal. Regular updates to the Linux kernel are essential to maintain security posture against such low-level synchronization defects in critical subsystems like InfiniBand and RoCE implementations.