CVE-2026-92513: RDMA/mana_ib: drain QP references after partial table insertion
In the Linux kernel, the following vulnerability has been resolved:
RDMA/manaib: drain QP references after partial table insertion
manatablestoreudqp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xainsertirq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free.
Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel RDMA mana_ib driver are exposed when they create unreliable datagram queue pairs and encounter a failure while inserting the receive-queue entry after the send-queue entry has already been published.
What is required to trigger the use-after-free condition?
A partial queue-pair table insertion must occur, with the second XArray insertion failing. A concurrent completion handler must also look up the partially published queue pair and acquire a transient reference before rollback.
How can administrators determine whether they may be affected?
Review whether the running kernel includes one of the referenced stable commits, and whether the mana_ib RDMA driver is in use. The vulnerable path involves concurrent completion handling during unreliable datagram queue-pair setup.