CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ibdeallocpduser()
When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget(). Currently, rdmarestrackdel() is invoked at the end of ibdeallocpduser(), which is too late, since by that point vendor-specific resources associated with the PD might already be freed. This can leave a short window where the PD remains accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdmarestrackbegindel() call to the start of ibdeallocpduser(), ensuring that the PD is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a PD that is in the process of destruction.
In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the PD destruction path (ib_dealloc_pd_user()), move the rdma_restrack_begin_del() call to the start of the flow so the PD is removed from restrack immediately, preventing a use-after-free window while the PD is still accessible via rdma_restrack_get() over the netlink path.
Linux kernel RDMA/core rdma_restrack_begin_del()/rdma_restrack_del() invocation order = Move rdma_restrack_begin_del() call to the start of the PD destruction flow (before ib_dealloc_pd_user() proceeds), so restrack is removed first thing during destruction and rdma_restrack_del() occurs at the end while preserving the intended inverted order
Event History
Frequently Asked Questions
What access path is involved in triggering this issue?
The vulnerable access path is netlink access to an RDMA protection domain (PD) while that PD is being deallocated. The race exists because the PD can remain visible through RDMA resource tracking after vendor-specific resources have begun to be freed.
What condition creates the use-after-free window?
The window occurs when rdma_restrack_del() is delayed until the end of ib_dealloc_pd_user(). During destruction, a netlink user may still obtain a reference through rdma_restrack_get() after internal PD resources have already been released.
What does the fix change?
The fix calls rdma_restrack_begin_del() at the start of ib_dealloc_pd_user(). This removes the PD from resource tracking before its internal resources are freed, preventing new users from acquiring references during destruction.