Cloudanix VulnDB

CVE-2026-92509

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's RDMA networking code could let an attacker on the same machine corrupt memory and potentially crash or take over the system.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Potential use-after-free in RDMA counter handling: rdma_restrack_del() was called after vendor-specific resources were freed, leaving a window where the counter remained reachable via restrack and could be accessed after free.

Why it matters to the business

Kernel memory corruption on RDMA-enabled systems can cause crashes, service outages, or local privilege escalation, affecting high-performance networking and storage workloads.

How an attack unfolds

An attacker with local access to the RDMA netlink interface triggers counter operations, races the release path, and dereferences a freed counter object through restrack before the fix ensures removal precedes resource cleanup.

How to fix it

Apply the upstream kernel commit that moves rdma_restrack_del() before vendor resource release; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the fix by inspecting the counter_release() function in the running kernel source or by verifying that restrack deletion occurs prior to resource freeing in the binary.

Typical attack path

  1. Obtain local access on a system with RDMA hardware and netlink exposure
  2. Issue RDMA counter netlink commands to obtain a restrack reference
  3. Trigger counter_release() while holding the reference
  4. Access the counter after vendor resources are freed but before restrack deletion
  5. Exploit the resulting use-after-free for memory corruption or code execution

How to detect it

Review kernel logs and dmesg for RDMA counter oops, use-after-free warnings, or restrack-related crashes; correlate with netlink activity on RDMA devices.

What your security team should do

  • Prioritize kernel updates on all RDMA-capable hosts
  • Restrict untrusted local access to RDMA netlink interfaces
  • Monitor kernel logs for RDMA counter-related oops or warnings
  • Test patched kernels in staging before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counter_release() When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of counter_release(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction.

Affected packages

Ecosystem Package Introduced Fixed