CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ibdeallocpduser()
When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget(). Currently, rdmarestrackdel() is invoked at the end of ibdeallocpduser(), which is too late, since by that point vendor-specific resources associated with the PD might already be freed. This can leave a short window where the PD remains accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdmarestrackbegindel() call to the start of ibdeallocpduser(), ensuring that the PD is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a PD that is in the process of destruction.
In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What access path is involved in triggering this issue?
The vulnerable access path is netlink access to an RDMA protection domain (PD) while that PD is being deallocated. The race exists because the PD can remain visible through RDMA resource tracking after vendor-specific resources have begun to be freed.
What condition creates the use-after-free window?
The window occurs when rdma_restrack_del() is delayed until the end of ib_dealloc_pd_user(). During destruction, a netlink user may still obtain a reference through rdma_restrack_get() after internal PD resources have already been released.
What does the fix change?
The fix calls rdma_restrack_begin_del() at the start of ib_dealloc_pd_user(). This removes the PD from resource tracking before its internal resources are freed, preventing new users from acquiring references during destruction.