CVE-2026-92514

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the RDMA/erdma component. The CEQ interrupt handler schedules eqc->tasklet, which executes the erdma ceq completion handler() function to read the DMA-coherent EQ ring via get next valid eqe() and update eq->dbrec through notify eq(). During the uninitialization process in erdma ceqs uninit(), the system frees the CEQ IRQ and destroys the EQ. While free irq() prevents new hard IRQs and waits for active handlers, it does not drain tasklets already scheduled. Consequently, the tasklet may attempt to access eq->qbuf or eq->dbrec after they have been freed by erdma eq destroy(). Clearing ceq cb->ready fails to synchronize with tasklets that have already passed the initial check in erdma ceq completion handler().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.