UBUNTU-CVE-2026-92514: Use After Free
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls erdmaceqcompletionhandler(), which reads the DMA-coherent EQ ring through getnextvalideqe() and updates eq->dbrec through notifyeq(). erdmaceqsuninit() frees each CEQ IRQ and then destroys its EQ. freeirq() prevents another hard IRQ and waits for an in-flight handler, but it does not drain a tasklet that the handler already scheduled. The tasklet can therefore access eq->qbuf or eq->dbrec after erdmaeqdestroy() frees them. Clearing ceqcb->ready does not synchronize with a tasklet that already passed the check at the start of erdmaceqcompletionhandler(). Kill the tasklet after freeirq(), when no handler can schedule it again, and before erdmacequninitone() releases the EQ buffers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In erdma_ceqs_uninit(), call free_irq() for each CEQ, then kill the associated tasklet, and only afterward call erdma_ceq_uninit_one() to release the EQ buffers; this prevents a previously scheduled tasklet from accessing freed eq->qbuf or eq->dbrec.
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
When can the use-after-free occur?
It can occur during CEQ removal when an interrupt handler has already scheduled a CEQ tasklet. After free_irq() prevents further handlers, the already scheduled tasklet may still run after the EQ buffers have been released.
Does clearing the CEQ ready flag prevent the race?
No. A tasklet may have already passed the ready check before the flag is cleared, and can still access the destroyed EQ resources.