UBUNTU-CVE-2026-92513: Use After Free
In the Linux kernel, the following vulnerability has been resolved: RDMA/manaib: drain QP references after partial table insertion manatablestoreudqp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xainsertirq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free. Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Operational
After partial QP table insertion, drain references as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup has returned its reference.
Event History
Frequently Asked Questions
Which systems are in scope for this issue?
The issue applies to the listed Ubuntu kernel packages: linux-riscv, linux-azure, linux-azure-fde, linux-realtime, linux-hwe-edge, linux-gcp, linux-gke, and linux-aws-5.0. It is specific to the mana_ib RDMA driver and QP handling.
What conditions are required for the use-after-free to occur?
A QP must be published under its send-queue ID while insertion under its receive-queue ID is still pending. During that window, a concurrent completion handler must obtain a transient QP reference, and the receive-queue insertion must then fail.