CVE-2026-92508

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) core component. When a Completion Queue (CQ) is accessed through the netlink path, a timing issue can occur where the CQ's resources are freed before it is properly removed from tracking. This creates a brief period where the system might attempt to use memory that has already been released, a condition known as a use-after-free. This vulnerability could potentially lead to system instability or other unpredictable behavior.

A race in RDMA core ib_free_cq can leave a completion queue visible through restrack while vendor specific CQ resources are already being destroyed or freed. A local process using the RDMA netlink restrack path may acquire a reference during this teardown window and access a CQ whose internal resources are no longer valid, creating a potential use after free condition. For the CVSS the PR:L is used because reliable triggering requires a local user or process with access to RDMA objects or RDMA netlink, but not necessarily full administrator privileges in all deployments. The issue is not directly network reachable because the vulnerable access path is local netlink control plane handling rather than RDMA packet traffic. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact due to the UAF class, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.