CVE-2026-92510

A flaw was found in the Linux kernel. When a Shared Receive Queue (SRQ) is accessed via the netlink path, the rdma_restrack_del() function is called too late during the ib_destroy_srq_user() process. This timing issue can lead to a use-after-free vulnerability, where previously freed memory resources might still be accessible. Exploitation of this flaw could result in memory corruption.

A race in RDMA SRQ destruction can leave an SRQ reachable through restrack while vendor specific resources are already being destroyed. A local actor can race ib_destroy_srq_user() with the RDMA netlink restrack access path, where rdma_restrack_get() is the main synchronization mechanism for that object. For the CVSS the PR:L value is used because reliable triggering requires local code execution with access to RDMA uverbs or RDMA netlink resource interfaces, but does not require full administrator privileges in deployments that grant RDMA device access to users. The issue is not directly network reachable through RDMA traffic alone and is triggered through local control plane object lifetime operations. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.