Cloudanix VulnDB

CVE-2026-92508

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A memory-handling mistake in the Linux kernel can let someone already logged into the machine read or change data they should not, potentially crashing the system or taking control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in RDMA core when a completion queue remains reachable via restrack after vendor resources are released during ib_free_cq().

Why it matters to the business

Local attackers on RDMA-enabled systems can trigger crashes or arbitrary code execution, risking service disruption on high-performance compute and storage clusters.

How an attack unfolds

An attacker with local access issues netlink operations against an RDMA completion queue while a concurrent ib_free_cq() path frees vendor resources, then dereferences the freed object through the still-registered restrack entry.

How to fix it

Apply the upstream kernel commit that moves rdma_restrack_del() before vendor resource release; rebuild and deploy the patched kernel on all affected hosts.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the ib_free_cq() implementation in the running kernel source or by verifying the kernel version contains the RDMA/core restrack ordering change.

Typical attack path

  1. Obtain local user access on a system with RDMA hardware and the RDMA netlink interface enabled.
  2. Create or reference a CQ via the RDMA netlink path.
  3. Trigger concurrent CQ destruction through ib_free_cq().
  4. Access the CQ object via restrack after vendor resources are freed but before restrack_del().
  5. Achieve use-after-free for denial of service or privilege escalation.

How to detect it

Review kernel logs for RDMA-related oops or use-after-free warnings, audit netlink RDMA operations around CQ lifecycle events, and inspect restrack entries for objects that should have been removed.

What your security team should do

  • Prioritize kernel updates on all hosts exposing RDMA netlink interfaces.
  • Restrict unprivileged access to RDMA devices and netlink where feasible.
  • Monitor for local privilege-escalation attempts targeting RDMA subsystems.

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_free_cq() When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_free_cq(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction.

Affected packages

Ecosystem Package Introduced Fixed