Cloudanix VulnDB

CVE-2026-92510

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's high-speed networking code can let a logged-in user corrupt memory and potentially take over the machine.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in RDMA core when an SRQ is accessed via the netlink path; rdma_restrack_del() occurs after vendor resources are released, allowing a window where restrack still holds a reference to a partially destroyed SRQ.

Why it matters to the business

Local attackers on Linux systems using RDMA can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation on servers that rely on high-speed networking fabrics.

How an attack unfolds

An attacker with local access invokes netlink operations against an SRQ while ib_destroy_srq_user() is running, racing the window between resource release and restrack removal to dereference freed memory.

How to fix it

Update to a Linux kernel containing the fix that moves rdma_restrack_begin_del() to the start of ib_destroy_srq_user(); rebuild and reboot affected systems.

How to confirm the fix worked

Verify the kernel source contains the reordered rdma_restrack_begin_del() call in ib_destroy_srq_user(); confirm the running kernel version includes the patch commit and test that netlink SRQ destruction no longer leaves restrack references.

Typical attack path

  1. Obtain local user access on a Linux host with RDMA support
  2. Open or create an SRQ via the RDMA netlink interface
  3. Trigger concurrent destruction of the SRQ while holding a restrack reference
  4. Access the freed SRQ object through the still-valid restrack entry
  5. Cause use-after-free dereference leading to corruption or control-flow hijack

How to detect it

Inspect kernel logs for oops or warnings referencing ib_destroy_srq_user or rdma_restrack around the time of suspected activity; correlate with processes using RDMA netlink sockets.

What your security team should do

  • Prioritize patching RDMA-enabled kernels on all production systems within the next maintenance window
  • Restrict local access and netlink RDMA capabilities to the minimum required users and services
  • Monitor for kernel oops or crashes involving RDMA restrack functions

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_srq_user() When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_destroy_srq_user(), which is too late, since by that point vendor-specific resources associated with the SRQ might already be freed. This can leave a short window where the SRQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of ib_destroy_srq_user(), ensuring that the SRQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a SRQ that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.

Affected packages

Ecosystem Package Introduced Fixed