CVE-2026-92512

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix use after free in ib_query_qp()

When querying a QP via the netlink flow the only synchronization

mechanism for the said QP is rdma_restrack_get(), meanwhile during the

QP destroy path rdma_restrack_del() is called at the end of the

ib_destroy_qp_user() function which is too late, since by then the

vendor specific resources for said QP would already be destroyed, and

till the rdma_restrack_del() is called this QP can still be accessed,

which could cause the use after free below.

Fix this by moving the rdma_restrack_begin_del() to the start of the

ib_destroy_qp_user(), which in turn waits for all usages of the QP to be

done then removes it from the database to prevent access to it while it

is being destroyed.

RIP: 0010:ib_query_qp+0x15/0x50 [ib_core]

Code: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 <48> 8b 07 48 8b 80 88

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References