CVE-2026-92513: RDMA/mana_ib: drain QP references after partial table insertion

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

RDMA/manaib: drain QP references after partial table insertion

manatablestoreudqp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xainsertirq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free.

Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.

Affected Software

1 affected component
Linux Kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:10 PM
Data Sourced
via MITRE·04:10 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel RDMA mana_ib driver are exposed when they create unreliable datagram queue pairs and encounter a failure while inserting the receive-queue entry after the send-queue entry has already been published.

2

What is required to trigger the use-after-free condition?

A partial queue-pair table insertion must occur, with the second XArray insertion failing. A concurrent completion handler must also look up the partially published queue pair and acquire a transient reference before rollback.

3

How can administrators determine whether they may be affected?

Review whether the running kernel includes one of the referenced stable commits, and whether the mana_ib RDMA driver is in use. The vulnerable path involves concurrent completion handling during unreliable datagram queue-pair setup.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203