CVE-2026-92488

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the RDMA/erdma component where the functions erdma destroy qp(), erdma destroy cq(), erdma dereg mr(), and erdma destroy ah() return early if erdma post cmd wait() fails. This behavior leads to the leakage of queue buffers, Memory Translation Tables (MTTs), doorbells, and identifiers including STAG, QPN, CQN, and AHN. When a command timeout occurs, the ERDMA CMDQ STATE OK BIT is cleared, permanently disabling the command queue and preventing successful retries. Consequently, the RDMA core retains the object after a failed destructor, and a forced uverbs cleanup subsequently nulls the pointers, rendering the resources unreachable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.