CVE-2026-92513

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mana_ib: drain QP references after partial table insertion

mana_table_store_ud_qp() publishes a QP at its send-queue id before

inserting the receive-queue id, dropping the XArray lock between the two

xa_insert_irq() calls. A concurrent completion handler can look up the QP

and take a transient reference. When the second insertion fails, the

rollback erased only the send-queue entry and returned, leaving both the

initial table reference and the transient reference outstanding while RDMA

core frees the QP, causing a use-after-free.

Drain the reference as normal destruction does: drop the initial reference

and wait for qp->free, releasing the QP only after every concurrent lookup

returns its reference.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References