« Volver al listado

CVE-2026-92513

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mana_ib: drain QP references after partial table insertion

mana_table_store_ud_qp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xa_insert_irq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free.

Leer descripción completaMostrar menos

Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-92513",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8001e9257eca23264550ff9e34598ee43a80f0f9",
              "lessThan": "4aaa2ab816c710be7385b31d08373edcdcd71656",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8001e9257eca23264550ff9e34598ee43a80f0f9",
              "lessThan": "638b9a5364c1482e5d104823c1a3884b3d249484",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8001e9257eca23264550ff9e34598ee43a80f0f9",
              "lessThan": "97f7c2262c28ebcae64fc957ee978646684a5ed9",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/infiniband/hw/mana/qp.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/infiniband/hw/mana/qp.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:54.140",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4aaa2ab816c710be7385b31d08373edcdcd71656",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/638b9a5364c1482e5d104823c1a3884b3d249484",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/97f7c2262c28ebcae64fc957ee978646684a5ed9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: drain QP references after partial table insertion\n\nmana_table_store_ud_qp() publishes a QP at its send-queue id before\ninserting the receive-queue id, dropping the XArray lock between the two\nxa_insert_irq() calls. A concurrent completion handler can look up the QP\nand take a transient reference. When the second insertion fails, the\nrollback erased only the send-queue entry and returned, leaving both the\ninitial table reference and the transient reference outstanding while RDMA\ncore frees the QP, causing a use-after-free.\n\nDrain the reference as normal destruction does: drop the initial reference\nand wait for qp->free, releasing the QP only after every concurrent lookup\nreturns its reference."
    }
  ],
  "lastModified": "2026-09-17T17:17:54.140",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}