CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq()

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix potential use after free in ibfreecq()

When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget(). Currently, rdmarestrackdel() is invoked at the end of ibfreecq(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free.

Fix this by moving the rdmarestrackdel() call to be before the freeing of the vendor-specific resources ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction.

Event History

Sep 17, 2026

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

Description

Frequently Asked Questions

What systems are exposed to this issue?

Systems using the Linux kernel RDMA subsystem are exposed when completion queues (CQs) can be accessed through the netlink resource-tracking path during CQ teardown. The issue involves vendor-specific CQ resources being freed while the CQ can still be found through restrack.

What race condition is required to trigger the use-after-free?

A netlink-path access must obtain or use a CQ through rdma_restrack_get() during the short interval after vendor-specific CQ resources have been freed but before rdma_restrack_del() removes the CQ from resource tracking. This can leave a reference to a CQ whose internal resources are already released.

How is the issue fixed?

The fix moves rdma_restrack_del() earlier in ib_free_cq(), before vendor-specific CQ resources are freed. This removes the CQ from restrack before destruction begins and prevents new users from obtaining references during teardown.

CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq()

Event History

Frequently Asked Questions

What systems are exposed to this issue?

What race condition is required to trigger the use-after-free?

How is the issue fixed?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this issue?

What race condition is required to trigger the use-after-free?

How is the issue fixed?