UBUNTU-CVE-2026-92509: Use After Free
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease() When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget(). Currently, rdmarestrackdel() is invoked at the end of counterrelease(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdmarestrackdel() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Move the rdma_restrack_del() call in counter_release() to before freeing vendor-specific resources, so the counter is removed from restrack before its internal resources are released.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running any of the listed Ubuntu kernel packages may be exposed when RDMA counters are accessed through the netlink path while a counter is being destroyed. Exploitation requires local access, high privileges, and a specific race condition.
What must occur for the use-after-free condition to be triggered?
A counter must remain reachable through RDMA resource tracking while its vendor-specific resources have already been freed during counter release. An attacker would need to access that counter through netlink during this short destruction window.
How can I determine whether a system is affected?
Check whether the system is running one of the listed Ubuntu kernel package variants and whether it uses RDMA counters accessible through the netlink path. The provided data does not identify fixed package versions or a runtime detection method.
What is the mitigation if an updated kernel cannot be deployed immediately?
The available information does not provide a documented workaround. Reducing access to privileged local users and avoiding RDMA counter operations through netlink during counter teardown may reduce exposure, but this is not stated as a complete mitigation.