Look up another CVE · open CVE-2026-92508 in the interactive tracker
CVE-2026-92508
RDMA/core: Fix potential use after free in ib_free_cq()
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem drivers/infiniband. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-92508 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_free_cq(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/infiniband/core/cq.c
- What this is
- INFINIBAND SUBSYSTEMMAINTAINERS section matched on drivers/infiniband/ · linux-rdma@vger.kernel.org · Supported
- Kernel module
- ib_core
Check it on the machine
grep -w CONFIG_INFINIBAND /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ib_corePrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_INFINIBAND
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 4.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/infiniband
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10 | 5.15.221 | a804b162f9bc |
| 5.10 | 6.1.188 | 91f8a17a22ab |
| 5.10 | 6.6.157 | 76f2cb4f7218 |
| 5.10 | 6.12.110 | b8dcca427096 |
| 5.10 | 6.18.52 | 9abea3794253 |
| 5.10 | 7.2.6 | 43403fe45379 |
| 5.10 | 7.3 | 29dc2f8e1c97 |
| 5.8.17 | 0 | 0 |
| 5.9.2 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The use side is a local NETLINK_RDMA RDMA_NLDEV_CMD_RES_CQ_GET handled by nldev_res_get_cq_doit/dumpit → res_get_common_doit/dumpit, which rdma_restrack_get()s a CQ still in the xarray while ib_free_cq() is destroying it. No remote protocol message carries the lookup; the accessor is a netlink syscall.
- AC:LAttack complexity, low
- The attacker drives both sides of the race: one thread loops RDMA_NLDEV_CMD_RES_CQ_GET while another opens and drops kernel-ULP RDMA connections so ib_free_cq() runs (svc_rdma_free() or smbdirect_connection_destroy_qp()). That is not a victim-only timing window.
- PR:LPrivileges required, low
- RDMA_NLDEV_CMD_RES_CQ_GET in nldev_cb_table has no RDMA_NL_ADMIN_PERM, and NETLINK_RDMA is created with NL_CFG_F_NONROOT_RECV, so an ordinary user can dump CQs. Kernel CQ teardown via /dev/infiniband/rdma_cm (ucma_misc mode 0666) also does not need init-namespace root.
- UI:NUser interaction, none
- The attacker sends the RDMA_NLDEV_CMD_RES_CQ_GET dumps and tears down their own kernel-ULP RDMA connections; no other user must mount a volume, open a device, or confirm an action.
- S:UScope, unchanged
- The UAF is of host-kernel CQ vendor state (ib_cq buffers freed in destroy_cq/pre_destroy_cq) and stays inside the same kernel authority; it is not a VM escape, IOMMU bypass, or guest-to-host boundary cross.
- C:HConfidentiality impact, high
- c4iw_destroy_cq() → destroy_cq() dma_free_coherent()s chp->cq.queue before rdma_restrack_del(); a concurrent fill_res_cq_entry → c4iw_fill_res_cq_entry still indexes that queue, so the UAF reads freed CQ-ring memory.
- I:HIntegrity impact, high
- The same ib_free_cq() window lets fill_res_cq_entry use vendor CQ resources already released by destroy_cq/pre_destroy_cq (Chelsio queue pages; mlx5 destroy_cq_kernel CQ buffers). Reclaiming that heap object yields an arbitrary write and control-flow hijack.
- A:HAvailability impact, high
- fill_res_cq_entry walking a CQ whose queue or HW context was already freed in ib_free_cq() (after pre_destroy_cq/destroy_cq, before rdma_restrack_del) oopses or panics the kernel even without a crafted exploit.