CVE-2026-92510

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the RDMA core component. When accessing a Shared Receive Queue (SRQ) via the netlink path, the synchronization relies on rdma restrack get(). Because rdma restrack del() was previously called at the end of the ib destroy srq user() function, vendor-specific resources associated with the SRQ could be freed while the SRQ remained accessible through restrack, creating a window for exploitation.

Recommendations As a temporary mitigation, restrict access to the ib destroy srq user() function or the RDMA core netlink path until the system is updated to a version where rdma restrack begin del() is called at the start of the destruction flow.