CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in counterrelease()
When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget(). Currently, rdmarestrackdel() is invoked at the end of counterrelease(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdmarestrackdel() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What access path is involved in this issue?
The affected access path is netlink access to an RDMA counter. The race exists because a counter can remain reachable through resource tracking while its vendor-specific resources are being freed.
What condition is required for the use-after-free window?
The counter must be in the process of release while it is accessed through the netlink path. Before the fix, rdma_restrack_del() ran only after vendor-specific counter resources were freed, allowing a short interval in which new users could obtain references to the destroying counter.
What does the fix change?
The fix moves rdma_restrack_del() earlier in counter_release(), before vendor-specific resources are freed. This removes the counter from resource tracking before destruction and prevents new users from acquiring references during teardown.