Skip to content
Heist/ feed
High

RDMA/core: Fix potential use after free in ib_destroy_cq_user()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_cq_user() When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_destroy_cq_user(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of ib_destroy_cq_user(), ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.

Announced Source revision 1
Original source ↗

CVE-2026-92511

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92511

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "08f294a1524bc3211a28091daa6c7513828c7d33",
        "lessThan": "42f7a0c7a94003059540cce448acabfa62ad119d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "08f294a1524bc3211a28091daa6c7513828c7d33",
        "lessThan": "253c2ed71a532c70fa0e64317ceb02bb1a50c84c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "08f294a1524bc3211a28091daa6c7513828c7d33",
        "lessThan": "b85a148731eceffacb6a030950187d785175607f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "08f294a1524bc3211a28091daa6c7513828c7d33",
        "lessThan": "197c262dbf94c0f7ab7ac54b66f892ce9f343232",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "08f294a1524bc3211a28091daa6c7513828c7d33",
        "lessThan": "8a72a6aad84b3928dbb5e564bff1f56a7ec222ae",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "08f294a1524bc3211a28091daa6c7513828c7d33",
        "lessThan": "3481bec4dfc4aee24ffea5a547ee95b70b67d9d5",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/infiniband/core/verbs.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.16"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.16",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.110",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.52",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/infiniband/core/verbs.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-92511

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#37760 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement