CVE-2026-93267

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem. During object deallocation, internal resources associated with a Direct Memory Access Handle (DMAH) may be freed before the handle is removed from resource tracking. A local attacker can exploit this race condition through netlink requests to reference already-freed memory, triggering a use-after-free condition. This flaw could lead to a denial of service (DoS) or potential privilege escalation.

A race condition was found in the Linux kernel RDMA subsystem where a Direct Memory Access Handle (DMAH) undergoing deallocation in uverbs_free_dmah() could have its vendor-specific resources freed before it was removed from RDMA resource tracking (restrack), leaving a short window in which the handle could still be reached through the netlink resource-tracking path. A local attacker with access to RDMA devices who is able to create and destroy DMAH objects while issuing concurrent netlink queries could exploit this race to reference already-freed memory, causing a use-after-free that could crash the kernel (denial of service) or potentially lead to privilege escalation. Red Hat has rated this flaw as Moderate for the affected products. The DMAH object APIs that contain this flaw were introduced in recent RHEL 9 (9.8 and later) and RHEL 10 (10.2 and later) kernels, and the flaw is also present in Red Hat In-Vehicle OS 2 and in OpenShift Container Platform releases shipped with affected RHEL 9-based CoreOS kernels. Earlier RHEL 6, 7, and 8 releases and older RHEL 9 and RHEL 10 update streams do not contain the vulnerable code and are therefore not affected. Red Hat has deferred the fix for the affected streams to a future planned update; because exploitation requires local access to RDMA-capable hardware, the ability to create DMAH objects, and winning a narrow race window, the residual risk while the fix is deferred is primarily local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.