{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-92510", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-16T12:21:13.872Z", "datePublished": "2026-09-17T16:10:20.775Z", "dateUpdated": "2026-10-19T09:04:16.292Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:04:16.292Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix potential use after free in ib_destroy_srq_user()\n\nWhen accessing a SRQ via the netlink path the only synchronization\nmechanism for the said SRQ is rdma_restrack_get().\nCurrently, rdma_restrack_del() is invoked at the end of\nib_destroy_srq_user(), which is too late, since by that point\nvendor-specific resources associated with the SRQ might already be\nfreed. This can leave a short window where the SRQ remains accessible\nthrough restrack, leading to a potential use-after-free.\n\nFix this by moving the rdma_restrack_begin_del() call to the start of\nib_destroy_srq_user(), ensuring that the SRQ is removed from restrack\nbefore its internal resources are released. This guarantees that no new\nusers hold references to a SRQ that is in the process of destruction.\n\nIn addition, this change preserves the intended inverted order\nbetween create and destroy routines: resources are added to\nrestrack at the end of successful creation, and hence shall be removed\nfrom the restrack first thing during the destruction flow, which keeps\nthe lifecycle management consistent and predictable." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Reached by a local write/ioctl on /dev/infiniband/uverbsN (IB_USER_VERBS_CMD_DESTROY_SRQ or UVERBS_METHOD_SRQ_DESTROY → uverbs_free_srq → ib_destroy_srq_user) raced with NETLINK_RDMA RDMA_NLDEV_CMD_RES_SRQ_GET; incoming RoCE/IB packets never invoke destroy_srq or fill_res_srq_entry.\nAC:L - The attacker controls both sides: one thread DESTROY_SRQs the handle while another issues RDMA_NLDEV_CMD_RES_SRQ_GET so nldev_res_get_srq_doit → rdma_restrack_get_byid still finds the SRQ during ops.destroy_srq (e.g. hns_roce_destroy_srq's mailbox and wait_for_completion); no uninfluenced victim state is required.\nPR:L - ib_uverbs_open() has no capable() check and uverbs_devnode() creates /dev/infiniband/uverbs* mode 0666, and RDMA_NLDEV_CMD_RES_SRQ_GET is registered without RDMA_NL_ADMIN_PERM, so an unprivileged local user on a host with an RDMA device can create an SRQ and dump it via nldev.\nUI:N - The attacker opens uverbs, creates the SRQ, and races DESTROY_SRQ with their own NETLINK_RDMA RES_SRQ_GET; no other user must mount, click, or otherwise act.\nS:U - The use-after-free is of the host-kernel ib_srq and its vendor SRQ resources inside ib_core; it does not escape a VM, bypass an IOMMU, or otherwise leave the kernel's authority.\nC:H - After ops.destroy_srq frees vendor state (hns free_srqc/free_srq_buf, rxe_srq_cleanup→rxe_queue_cleanup, bnxt_qplib_destroy_srq kfree(swq)), the SRQ is still in restrack so fill_res_srq_entry/fill_res_srq_entry_raw (hns query_srqc, bnxt_qplib_read_context) read the freed object, a UAF disclosure primitive.\nI:H - The same UAF leaves vendor SRQ allocations (bnxt swq, siw recvq, rxe queue, mlx5 umem) freed while nldev still holds the restrack kref in fill_res_srq_entry, so heap reuse of those objects yields a write/control-flow primitive.\nA:H - fill_res_srq_entry walking an SRQ whose vendor buffers were already released by destroy_srq (kfree/vfree of swq, recvq, or rxe queue) can oops the kernel, so availability impact is high even without a full exploit." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/core/verbs.c" ], "versions": [ { "version": "48f8a70e899fa4d9c8f00369f482f0382173ece9", "lessThan": "a5bfd9fe05d5cebbd3e447bf7f7b2c663007d8b9", "status": "affected", "versionType": "git" }, { "version": "48f8a70e899fa4d9c8f00369f482f0382173ece9", "lessThan": "d3d0eabe6e39b024deb3e085e2d408d037e967c3", "status": "affected", "versionType": "git" }, { "version": "48f8a70e899fa4d9c8f00369f482f0382173ece9", "lessThan": "9c704383529044c02122f85a2a9a42cbf14a07a6", "status": "affected", "versionType": "git" }, { "version": "48f8a70e899fa4d9c8f00369f482f0382173ece9", "lessThan": "bedd7dee72588c838f5b67197ea8b387e7beb918", "status": "affected", "versionType": "git" }, { "version": "48f8a70e899fa4d9c8f00369f482f0382173ece9", "lessThan": "95c992c869df54a6a7061f5f3fb6400244f2af8f", "status": "affected", "versionType": "git" }, { "version": "48f8a70e899fa4d9c8f00369f482f0382173ece9", "lessThan": "88244ecc71cc0b3ed200f5ef7ddea6686adfd730", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/core/verbs.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.188" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.110" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.52" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a5bfd9fe05d5cebbd3e447bf7f7b2c663007d8b9" }, { "url": "https://git.kernel.org/stable/c/d3d0eabe6e39b024deb3e085e2d408d037e967c3" }, { "url": "https://git.kernel.org/stable/c/9c704383529044c02122f85a2a9a42cbf14a07a6" }, { "url": "https://git.kernel.org/stable/c/bedd7dee72588c838f5b67197ea8b387e7beb918" }, { "url": "https://git.kernel.org/stable/c/95c992c869df54a6a7061f5f3fb6400244f2af8f" }, { "url": "https://git.kernel.org/stable/c/88244ecc71cc0b3ed200f5ef7ddea6686adfd730" } ], "title": "RDMA/core: Fix potential use after free in ib_destroy_srq_user()", "x_generator": { "engine": "bippy-1.2.0" } } } }