Cloudanix VulnDB

CVE-2026-92507

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's management of certain network resources can let local users cause system crashes or run their own code.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ib_dealloc_pd_user() where rdma_restrack_del() occurs after vendor resources are freed, leaving a window for netlink restrack access to a PD undergoing destruction.

Why it matters to the business

Local attackers on affected Linux systems can trigger crashes or arbitrary code execution, disrupting RDMA-dependent workloads such as high-performance networking or storage and potentially leading to full system compromise.

How an attack unfolds

A local user with RDMA access triggers PD deallocation; the short window before restrack removal allows concurrent netlink access to reference already-freed internal structures, resulting in use-after-free.

How to fix it

Apply the upstream kernel patch that moves rdma_restrack_begin_del() to the beginning of ib_dealloc_pd_user() before any resource release; rebuild and deploy the fixed kernel.

How to confirm the fix worked

Inspect the ib_dealloc_pd_user() implementation in the RDMA core to confirm restrack deletion precedes vendor resource teardown; verify the inverted create/destroy lifecycle order is preserved.

Typical attack path

  1. Obtain local access on a system with RDMA enabled
  2. Invoke ib_dealloc_pd_user() via userspace RDMA API
  3. Concurrently access the PD through the netlink restrack path
  4. Reference freed memory to achieve UAF primitive

How to detect it

Review kernel logs for RDMA-related oops or use-after-free warnings; inspect netlink restrack activity around PD deallocation events in system call traces.

What your security team should do

  • Prioritize kernel updates on all systems exposing RDMA interfaces
  • Restrict unprivileged RDMA access via device permissions or namespaces until patched
  • Monitor kernel update channels for the specific RDMA core fix

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_dealloc_pd_user(), which is too late, since by that point vendor-specific resources associated with the PD might already be freed. This can leave a short window where the PD remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of ib_dealloc_pd_user(), ensuring that the PD is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a PD that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.

Affected packages

Ecosystem Package Introduced Fixed