Cloudanix VulnDB

CVE-2026-92512

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's RDMA networking code can let a local user trigger crashes or memory corruption during certain query and cleanup operations on high-speed network hardware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ib_query_qp() triggered when a QP is queried over netlink while it is simultaneously being destroyed; rdma_restrack_del() occurs after vendor resources are already freed, allowing continued access to the freed QP object.

Why it matters to the business

Systems using RDMA/InfiniBand hardware can experience kernel crashes or memory corruption, leading to denial of service or potential local privilege escalation; the issue affects Linux kernels with RDMA support and requires prompt patching to maintain stability and security.

How an attack unfolds

An attacker with local access triggers concurrent QP query and destroy operations via netlink interfaces; the race between ib_query_qp() and ib_destroy_qp_user() allows the query path to dereference a freed object after vendor resources are released but before restrack removal.

How to fix it

Update to a Linux kernel containing the fix that moves rdma_restrack_begin_del() to the beginning of ib_destroy_qp_user(); rebuild and deploy the patched kernel across all affected hosts; disable RDMA interfaces if immediate patching is not possible.

How to confirm the fix worked

Verify the presence of the upstream commit that relocates rdma_restrack_begin_del(); test by exercising netlink QP query and destroy paths concurrently under load and confirm no use-after-free occurs; inspect kernel logs for the original oops signature during validation.

Typical attack path

  1. Obtain local access on a Linux system with RDMA hardware and ib_core loaded
  2. Use netlink RDMA commands to initiate a QP query while triggering QP destruction
  3. Exploit the window between vendor resource teardown and rdma_restrack_del() to access freed memory
  4. Cause kernel oops, memory corruption, or attempt to leverage UAF for code execution

How to detect it

Review kernel logs for oops traces referencing ib_query_qp and mlx5_ib_query_qp; look for unusual netlink RDMA resource queries occurring immediately before QP destruction events; correlate with processes using RDMA verbs or netlink sockets.

What your security team should do

  • Prioritize kernel updates on all RDMA-enabled systems within the next patch cycle
  • Monitor for any new EPSS or KEV updates indicating increased exploit activity
  • Consider temporary RDMA feature disablement on high-risk or internet-facing systems until patched
  • Add kernel crash and RDMA netlink activity to routine security monitoring

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ib_query_qp() When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdma_restrack_get(), meanwhile during the QP destroy path rdma_restrack_del() is called at the end of the ib_destroy_qp_user() function which is too late, since by then the vendor specific resources for said QP would already be destroyed, and till the rdma_restrack_del() is called this QP can still be accessed, which could cause the use after free below. Fix this by moving the rdma_restrack_begin_del() to the start of the ib_destroy_qp_user(), which in turn waits for all usages of the QP to be done then removes it from the database to prevent access to it while it is being destroyed. RIP: 0010:ib_query_qp+0x15/0x50 [ib_core] Code: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 <48> 8b 07 48 8b 80 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff RSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370 RDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000 RBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004 R10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370 R13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c FS: 00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0 Call Trace: <TASK> mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib] mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib] ib_query_qp+0x35/0x50 [ib_core] fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core] ? __wake_up+0x40/0x50 ? netlink_broadcast_filtered+0x15a/0x550 ? kobject_uevent_env+0x562/0x710 ? ep_poll_callback+0x242/0x270 ? __nla_put+0xc/0x20 ? nla_put+0x28/0x40 ? nla_put_string+0x2e/0x40 [ib_core] fill_res_qp_entry+0x138/0x190 [ib_core] res_get_common_dumpit+0x4a5/0x800 [ib_core] ? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core] nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core] netlink_dump+0x16f/0x450 __netlink_dump_start+0x1ce/0x2e0 rdma_nl_rcv_msg+0x1d3/0x330 [ib_core] ? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core] rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core] rdma_nl_rcv+0x12/0x20 [ib_core] netlink_unicast+0x255/0x380 ? __alloc_skb+0xfa/0x1e0 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x230 ? copy_msghdr_from_user+0xea/0x170 ___sys_sendmsg+0x7c/0xb0 ? __futex_wait+0x95/0xf0 ? __futex_wake_mark+0x40/0x40 ? futex_wait+0x67/0x100 ? futex_wake+0xac/0x1b0 __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xb90 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Affected packages

Ecosystem Package Introduced Fixed