CVE-2026-92512

A flaw was found in the Linux kernel's RDMA core component. A local attacker could exploit a use-after-free vulnerability due to improper synchronization during the Query Packet (QP) destruction process. This could lead to a system crash, resulting in a denial of service, or potentially allow for information disclosure or arbitrary code execution.

A race in RDMA QP resource tracking can allow a QP to remain visible to the netlink query path while ib_destroy_qp_user is already destroying vendor specific QP resources. A local process can race RDMA netlink QP dumping against QP destruction, causing ib_query_qp to access stale or partially destroyed kernel driver state and triggering a use-after-free condition. For the CVSS the PR:L is used because reliable triggering requires local user access to RDMA userspace or RDMA netlink interfaces, not full administrative privileges in the common practical model. The issue is not directly network reachable because the vulnerable path is the local RDMA control plane rather than remote packet processing. Impact is at least local denial of service via kernel crash. In the paranoid interpretation, the UAF bug class and vendor object lifetime mismatch may allow confidentiality or integrity impact and possible privilege escalation, so this case should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.