CVE-2026-92509

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) core component. When a counter is accessed via the netlink path, the rdma_restrack_del() function is invoked too late during the counter_release() process. This timing issue can lead to a use-after-free vulnerability, where vendor-specific resources associated with the counter might be freed while the counter remains accessible, potentially allowing an attacker to exploit the freed memory.

A race in RDMA counter destruction can leave a counter visible through restrack while vendor specific resources are already being released. A local process using the RDMA netlink path may obtain or race a reference to the counter during this destruction window, creating a use after free candidate in kernel memory. For the CVSS the PR:L is used because triggering requires a local user or process context with access to RDMA netlink operations, but not necessarily full administrative control in all deployments. The issue is not directly network reachable because it is triggered through the local control plane rather than remote RDMA traffic. Impact is at least local denial of service via kernel crash and in the paranoid case may include privilege escalation or confidentiality and integrity impact due to the UAF class.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.