CVE-2026-93154

What it actually does

Missing reference counting on memory regions backing QP/CQ/SRQ rings allows userspace to trigger deregistration while the kernel still holds references, resulting in a use-after-free condition.

Why it matters to the business

Local attackers can crash systems or execute arbitrary code with kernel privileges on servers using RDMA hardware, leading to denial of service or full host compromise in high-performance computing and storage environments.

How an attack unfolds

An attacker with local access maps user-space rings, associates them with RDMA objects, then issues deregistration calls before the kernel finishes using the backing memory regions; the resulting dangling pointers are dereferenced to achieve use-after-free for code execution or DoS.

How to fix it

Upgrade to a Linux kernel containing the refcounting fix for RDMA/irdma user ring MRs; rebuild and reboot all affected hosts; where immediate patching is impossible, restrict untrusted local users and disable RDMA interfaces for non-essential workloads.

How to confirm the fix worked

Confirm the presence of the upstream commit that adds refcounting on MR association for user rings; run kernel regression tests exercising QP/CQ/SRQ creation and teardown under concurrent deregistration attempts; verify no crashes or slab-use-after-free reports occur.

Typical attack path

1. Obtain local unprivileged access on a system with RDMA/irdma hardware enabled
2. Create user-space memory regions and associate them with QP/CQ/SRQ rings
3. Trigger deregistration of the MR while kernel paths still reference the ring memory
4. Reuse the freed memory via crafted allocations or page spraying to corrupt kernel structures
5. Escalate to arbitrary kernel code execution or cause kernel panic

How to detect it

Review kernel logs for irdma-related slab use-after-free or page fault messages; inspect auditd or syscall logs for unusual deregistration sequences on RDMA file descriptors; correlate with process creation of RDMA test utilities or custom user-space ring mapping code.

What your security team should do

• Prioritize kernel updates on all RDMA-enabled production systems within standard change windows
• Audit local user privileges on hosts that expose RDMA devices
• Add monitoring for kernel oops or use-after-free warnings involving irdma
• Plan hardware or driver replacement if upstream fixes are unavailable for the deployed kernel series