CVE-2026-92514 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Fix CEQ tasklet use-after-free on removal
Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls erdma_ceq_completion_handler(), which reads the DMA-coherent EQ ring through get_next_valid_eqe() and updates eq->dbrec through notify_eq().
erdma_ceqs_uninit() frees each CEQ IRQ and then destroys its EQ. free_irq() prevents another hard IRQ and waits for an in-flight handler, but it does not drain a tasklet that the handler already scheduled. The tasklet can therefore access eq->qbuf or eq->dbrec after erdma_eq_destroy() frees them.
Clearing ceq_cb->ready does not synchronize with a tasklet that already passed the check at the start of erdma_ceq_completion_handler().
Kill the tasklet after free_irq(), when no handler can schedule it again, and before erdma_ceq_uninit_one() releases the EQ buffers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's RDMA/erdma subsystem represents a classic use-after-free condition arising from improper synchronization between interrupt handling contexts and resource cleanup routines. Specifically, this flaw affects the Completion Event Queue (CEQ) tasklet mechanism used by the erdma driver to process hardware completion events. The core of the issue lies in the lifecycle management of the CEQ structures during device removal or driver unloading sequences. When the system initiates the teardown process via erdma_ceqs_uninit, it proceeds to free each associated CEQ interrupt request and subsequently destroys the underlying Event Queue (EQ) data structures. While the kernel's standard API function free_irq is invoked to release the hardware interrupt line, this operation only guarantees that no new hard interrupts will be delivered by the hardware and waits for any currently executing hard IRQ handler instances to complete. It does not, however, account for softirq contexts such as tasklets that may have already been scheduled by a previously running interrupt handler but are still pending execution in the software context.
The technical flaw manifests when an interrupt occurs just before or during the initiation of the cleanup sequence. The hard IRQ handler schedules the erdma_ceq_completion_handler to run later as a tasklet, which is designed to read from the DMA-coherent EQ ring buffer and update doorbell records via notify_eq. Because tasklets are asynchronous software contexts that can execute after their scheduling source has returned, there exists a race window where the cleanup routine proceeds to free the memory associated with eq->qbuf and eq->dbrec while the scheduled tasklet is still queued for execution. Consequently, when the deferred tasklet finally runs, it attempts to dereference pointers to these now-freed memory regions. This results in a use-after-free vulnerability, which can lead to kernel panics, data corruption, or potentially be exploited by local attackers with sufficient privileges to trigger device removal scenarios to cause denial of service or gain unauthorized access to freed heap metadata for further exploitation techniques such as arbitrary write primitives through slab allocator manipulation.
From an industry standards perspective, this vulnerability is categorized under CWE-416: Use After Free, which describes the danger of accessing memory after it has been released without proper synchronization mechanisms in place. The operational impact primarily centers on system stability and availability, as triggering this condition during device removal can crash the host kernel. In more complex attack scenarios involving local privilege escalation, an attacker might leverage the unpredictable state resulting from the use-after-free to corrupt kernel heap structures, potentially leading to code execution with kernel-level privileges. Furthermore, within the MITRE ATT&CK framework for enterprise security, this type of vulnerability aligns with techniques related to Defense Evasion and Privilege Escalation, specifically those involving memory corruption vulnerabilities that allow attackers to bypass standard access controls by manipulating low-level system resources.
The resolution implemented in the kernel addresses this race condition by enforcing a strict ordering during resource deallocation. The fix involves explicitly killing or flushing the tasklet after free_irq has been called but before erdma_ceq_uninit_one releases the EQ buffers. By ensuring that no pending software interrupts remain active when the underlying memory is freed, the driver eliminates the window of opportunity for stale pointers to be dereferenced. This approach aligns with best practices in kernel development regarding interrupt context management, emphasizing that softirq handlers must be fully drained before their associated data structures are destroyed. To mitigate similar risks in other drivers or subsystems, developers should ensure that all asynchronous work items scheduled by hard IRQ handlers are explicitly cancelled and flushed prior to freeing any memory resources accessed by those handlers. Additionally, utilizing synchronization primitives such as mutexes or atomic flags can help prevent race conditions where cleanup routines might proceed while deferred execution contexts are still active, thereby maintaining the integrity of kernel memory management operations during device lifecycle transitions.