CVE-2026-92513 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mana_ib: drain QP references after partial table insertion
mana_table_store_ud_qp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xa_insert_irq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free.
Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel vulnerability identified in the RDMA mana_ib driver involves a critical race condition within the queue pair management logic, specifically during the insertion of Queue Pair references into an XArray data structure. The core technical flaw resides in the mana_table_store_ud_qp function, which is responsible for registering new Queue Pairs with send and receive queues. During this process, the implementation publishes the QP at its send-queue identifier before completing the insertion of the receive-queue identifier. Crucially, the code drops the XArray lock between these two xa_insert_irq calls to allow other operations to proceed concurrently. This design choice creates a narrow but exploitable window where the system state is inconsistent and partially visible to concurrent threads.
A concurrent completion handler can exploit this timing gap by performing a lookup on the QP while it exists in the table only via its send-queue ID. Upon finding the entry, the handler takes a transient reference to the QP object, assuming the entire structure is valid and fully initialized. However, if the subsequent insertion of the receive-queue identifier fails due to resource constraints or other errors, the rollback mechanism triggers. This rollback correctly removes the send-queue entry from the table but returns immediately without addressing the references held by concurrent operations that may have accessed the QP during its partial existence.
The consequence of this incomplete cleanup is a use-after-free vulnerability. The initial reference taken when inserting into the XArray and the transient reference acquired by the completion handler remain outstanding even after the RDMA core begins to free the QP memory due to the failed insertion. When these references are eventually dereferenced, they point to freed or invalid memory regions, leading to potential kernel crashes, data corruption, or arbitrary code execution depending on how an attacker can manipulate the freed memory state. This scenario aligns with CWE-416, Use After Free, as well as CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, highlighting both the resource management failure and the concurrency control deficiency.
From a threat modeling perspective utilizing the MITRE ATT&CK framework, this vulnerability facilitates privilege escalation or denial of service through improper synchronization leading to memory corruption. An attacker who can trigger rapid queue pair insertions and completions might influence kernel execution flow by exploiting the dangling pointer. The operational impact includes system instability and potential compromise of host integrity within RDMA-enabled environments such as high-performance computing clusters or cloud infrastructure relying on remote direct memory access for low-latency communication.
To mitigate this vulnerability, the fix implements a robust reference draining mechanism that mirrors standard QP destruction procedures. Instead of simply rolling back the table entry upon failure, the updated code drops the initial reference and explicitly waits for qp->free to complete. This ensures that all concurrent lookups have returned their references before the QP is actually freed from memory. By enforcing this synchronization point, the kernel guarantees that no active threads hold a pointer to the object during its deallocation phase. System administrators should apply the latest kernel updates containing this patch immediately to close the race condition window and prevent potential exploitation in production environments running affected versions of the Linux kernel with RDMA support enabled.