CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ibdestroysrquser()
When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdmarestrackget(). Currently, rdmarestrackdel() is invoked at the end of ibdestroysrquser(), which is too late, since by that point vendor-specific resources associated with the SRQ might already be freed. This can leave a short window where the SRQ remains accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdmarestrackbegindel() call to the start of ibdestroysrquser(), ensuring that the SRQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a SRQ that is in the process of destruction.
In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In Linux RDMA/core, move the rdma_restrack_begin_del() call to the start of ib_destroy_srq_user(), so the SRQ is removed from restrack before vendor-specific and other internal SRQ resources are released.
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel RDMA subsystem and shared receive queues (SRQs) that can be accessed through the RDMA netlink/restrack path are exposed. The issue occurs while an SRQ is being destroyed and remains visible through restrack after vendor-specific SRQ resources have begun to be freed.
What condition is required to trigger the use-after-free?
A concurrent netlink-path access must obtain or use the SRQ through restrack during the short destruction window. The vulnerable ordering permits new references while SRQ-associated vendor resources may already have been released.
What does the fix change?
The fix moves rdma_restrack_begin_del() to the start of ib_destroy_srq_user(). This removes the SRQ from restrack before internal resources are released, preventing new users from acquiring references to an SRQ undergoing destruction.