Cloudanix VulnDB

CVE-2026-93109

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in Linux kernel networking hardware support could let a local user cause system crashes on specialized high-speed network setups.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in mlx5 RDMA driver when devx_free_subscription RCU callback remains queued after module reference drop or auxiliary driver detach, allowing mlx5_ib unload before callback execution.

Why it matters to the business

Potential kernel instability or crashes on systems using RDMA over InfiniBand, affecting performance-critical workloads like high-speed networking or storage; low immediate risk given stable low exploit probability and no known active campaigns.

How an attack unfolds

An attacker with local access triggers DevX event subscriptions followed by precise timing of driver unload or registration error paths to execute the stale RCU callback after the module is gone, leading to memory corruption.

How to fix it

Apply the upstream kernel patch that drains RCU callbacks during mlx5 module teardown; rebuild and deploy updated kernel images across affected systems.

How to confirm the fix worked

Verify kernel source contains the RCU drain logic in mlx5 teardown paths; confirm no queued callbacks remain after module unload via code review or runtime tracing.

Typical attack path

  1. Obtain local access on Linux system with mlx5 RDMA hardware
  2. Create DevX event file subscriptions
  3. Force auxiliary driver detach or module teardown sequence
  4. Trigger registration error unwind or final reference drop
  5. Execute code or cause denial of service via freed memory access

How to detect it

Review kernel logs and crash dumps for mlx5 module unload races or use-after-free signatures; correlate with DevX event file activity around driver detach events.

What your security team should do

  • Prioritize kernel updates for RDMA-enabled servers within standard maintenance windows
  • Monitor for future exploit maturity increases given 37-day publication age and stable EPSS
  • Test driver unload sequences in staging environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devx_free_subscription() can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5_ib can then unload before the callback runs. Registration error unwind has the same risk because driver registration can attach existing devices before failing. Wait after all drivers have stopped.

Affected packages

Ecosystem Package Introduced Fixed