CVE-2026-92511

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) core. A timing issue during the cleanup of a Completion Queue (CQ) when accessed through the netlink path can lead to a use-after-free vulnerability. This could allow an attacker to cause memory corruption, potentially leading to system instability or denial of service.

A race in RDMA CQ destruction can leave a CQ reachable through restrack while vendor specific CQ resources are already being destroyed. A local actor that can use RDMA objects and query the RDMA netlink restrack path may hit a use after free window when ib_destroy_cq_user runs concurrently with restrack access. For the CVSS the PR:L is used in the paranoid score because reliable triggering may only require a local user or service account with access to RDMA device interfaces rather than full host administrator privileges. The issue is not directly network reachable over IP and requires local interaction with RDMA control interfaces. Impact is at least local denial of service via kernel crash. In worst case the UAF nature may allow confidentiality or integrity impact depending on the vendor driver state that is freed and later observed or reused, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.