Cloudanix VulnDB

CVE-2026-92511

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's high-speed networking code could let a local user trigger crashes or take control by accessing memory that should no longer be available.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in RDMA core when a completion queue remains reachable via restrack after vendor resources are released during ib_destroy_cq_user().

Why it matters to the business

Local attackers on systems using RDMA (InfiniBand, RoCE, iWARP) can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation in high-performance computing, storage, and networking environments.

How an attack unfolds

An attacker with local access issues netlink operations against a completion queue while ib_destroy_cq_user() is executing; because restrack removal occurs after internal resources are freed, the attacker can obtain a reference to already-freed memory and trigger the use-after-free.

How to fix it

Upgrade to a Linux kernel containing the fix that moves rdma_restrack_begin_del() to the start of ib_destroy_cq_user(). Rebuild and reboot with the patched kernel; disable RDMA interfaces if immediate patching is not possible.

How to confirm the fix worked

Verify the presence of the upstream commit that relocates rdma_restrack_begin_del(); confirm that restrack removal occurs before vendor resource teardown in the destroy path; test netlink CQ operations under concurrent destroy workloads.

Typical attack path

  1. Obtain local unprivileged access on a Linux system with RDMA enabled
  2. Use netlink interface to reference a completion queue via rdma_restrack_get()
  3. Trigger concurrent destruction of the same CQ through ib_destroy_cq_user()
  4. Access freed memory through the stale restrack reference before rdma_restrack_del() completes

How to detect it

Review kernel logs for oops or slab-use-after-free warnings referencing rdma_restrack or ib_destroy_cq_user; inspect netlink RDMA operations around the time of any RDMA-related crashes.

What your security team should do

  • Prioritize kernel updates on all RDMA-enabled hosts within the next maintenance window
  • Audit systems for RDMA usage and restrict netlink access to trusted users where feasible
  • Monitor for kernel oops or memory corruption reports involving rdma_restrack or ib_destroy_cq

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_cq_user() When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_destroy_cq_user(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of ib_destroy_cq_user(), ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.

Affected packages

Ecosystem Package Introduced Fixed