CVE-2026-92513
NoneCVSS
—
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A flaw in the Linux kernel's handling of certain high-speed network connections could let an attacker on the same machine crash the system or gain full control.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in RDMA/mana_ib QP table insertion where mana_table_store_ud_qp() publishes a send-queue entry before the receive-queue entry, allowing a concurrent completion handler to obtain a transient reference; on insertion failure the rollback leaves both references, so RDMA core frees the QP while it is still reachable.
Why it matters to the business
Kernel memory corruption on systems using Azure MANA RDMA hardware can cause crashes, data corruption, or local privilege escalation, disrupting workloads and requiring urgent patching across Linux servers and containers.
How an attack unfolds
An attacker with local access triggers concurrent RDMA QP creation and completion paths so that a transient reference survives the failed second xa_insert; when the QP is subsequently freed the dangling reference leads to use-after-free, enabling memory corruption or control-flow hijacking inside the kernel.
How to fix it
Update the Linux kernel to a version containing the fix that drains the QP reference and waits for qp->free before release; rebuild and reboot all affected systems; disable mana_ib if the hardware is not required.
How to confirm the fix worked
Confirm the patched kernel contains the drain logic after the second xa_insert failure; run RDMA QP creation and completion stress tests under concurrency; verify no UAF reports in kmemleak or KASAN during testing.
Typical attack path
- Obtain local code execution on a Linux host with mana_ib RDMA enabled.
- Race QP insertion (send-queue publish) against a concurrent completion handler.
- Force the second xa_insert to fail so rollback leaves both references.
- Trigger RDMA core QP destruction while the transient reference remains.
- Use the resulting UAF for memory write or code execution.
How to detect it
Review kernel logs for UAF or slab corruption messages involving mana_ib or RDMA QP structures; correlate with RDMA application activity and look for unexpected process crashes or privilege-escalation attempts around the time of QP operations.
What your security team should do
- Apply the upstream fix or vendor kernel update within the next maintenance window.
- Inventory all hosts using mana_ib or Azure RDMA hardware.
- Monitor EPSS and KEV status for any future increase in exploit activity.
- Consider disabling unused RDMA interfaces until patches are deployed.
The record
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: drain QP references after partial table insertion mana_table_store_ud_qp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xa_insert_irq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free. Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|