CVE-2026-92511 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ib_destroy_cq_user()
When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_destroy_cq_user(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_begin_del() call to the start of ib_destroy_cq_user(), ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction.
In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel contains a critical synchronization flaw within the Remote Direct Memory Access core subsystem that results in a potential use-after-free vulnerability when managing Completion Queues through the netlink interface. This issue specifically affects the ib_destroy_cq_user function, which is responsible for tearing down user-space completion queue resources. The root cause lies in an incorrect ordering of resource tracking operations relative to actual memory deallocation. Specifically, while rdma_restrack_get provides a synchronization mechanism during access, the removal of the Completion Queue from the restriction tracker via rdma_restrack_del occurs at the very end of the destruction routine. This timing creates a dangerous window where vendor-specific resources associated with the CQ may already have been freed by internal cleanup logic, yet the object remains registered in the restrack subsystem as accessible.
This architectural misalignment allows for a race condition wherein concurrent access attempts can locate and interact with a Completion Queue that is partially destroyed or whose underlying memory has been reclaimed. Such an interaction constitutes a use-after-free vulnerability, which falls under CWE-416 in standard classification systems. In practical terms, this flaw could be exploited by local users to cause kernel crashes through denial of service conditions or potentially lead to arbitrary code execution if the freed memory is reallocated and accessed with malicious intent before being properly sanitized. The severity is compounded by the fact that netlink paths are often exposed to user-space applications, increasing the attack surface for potential exploitation vectors within unprivileged contexts.
The remediation strategy involves a precise adjustment to the lifecycle management of Completion Queue resources in the kernel source code. By moving the rdma_restrack_begin_del call to the very beginning of ib_destroy_cq_user, developers ensure that the CQ is immediately marked as unavailable for new references before any internal resource release operations take place. This change effectively closes the race window by guaranteeing that no new users can acquire a reference to a Completion Queue that is currently undergoing destruction. The fix maintains consistency with the inverted lifecycle pattern where resources are added at the end of creation and removed at the start of destruction, thereby preserving predictable state transitions within the RDMA subsystem.
From an operational security perspective, this vulnerability highlights the importance of strict ordering in resource management routines to prevent transient states that violate memory safety guarantees. The fix aligns with best practices for preventing CWE-416 by ensuring that object references are invalidated prior to deallocation. For system administrators and developers, applying the patched kernel version is essential to mitigate risks associated with local privilege escalation or service disruption via RDMA interfaces. Furthermore, this incident underscores the need for rigorous code review processes focusing on synchronization primitives in high-concurrency subsystems like RDMA/core to prevent similar timing-based vulnerabilities from being introduced into the kernel base.