« Volver al listado

CVE-2026-92512

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix use after free in ib_query_qp()

When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdma_restrack_get(), meanwhile during the QP destroy path rdma_restrack_del() is called at the end of the ib_destroy_qp_user() function which is too late, since by then the vendor specific resources for said QP would already be destroyed, and till the rdma_restrack_del() is called this QP can still be accessed, which could cause the use after free below.

Fix this by moving the rdma_restrack_begin_del() to the start of the ib_destroy_qp_user(), which in turn waits for all usages of the QP to be done then removes it from the database to prevent access to it while it is being destroyed.

Detalles técnicos trazas, registros y código del informe original
RIP: 0010:ib_query_qp+0x15/0x50 [ib_core]
Code: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 <48> 8b 07 48 8b 80 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff
RSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370
RDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000
RBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004
R10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370
R13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c
FS:  00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0
Call Trace:
 <TASK>
 mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib]
 mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib]
 ib_query_qp+0x35/0x50 [ib_core]
 fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core]
 ? __wake_up+0x40/0x50
 ? netlink_broadcast_filtered+0x15a/0x550
 ? kobject_uevent_env+0x562/0x710
 ? ep_poll_callback+0x242/0x270
 ? __nla_put+0xc/0x20
 ? nla_put+0x28/0x40
 ? nla_put_string+0x2e/0x40 [ib_core]
 fill_res_qp_entry+0x138/0x190 [ib_core]
 res_get_common_dumpit+0x4a5/0x800 [ib_core]
 ? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core]
 nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core]
 netlink_dump+0x16f/0x450
 __netlink_dump_start+0x1ce/0x2e0
 rdma_nl_rcv_msg+0x1d3/0x330 [ib_core]
 ? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core]
 rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core]
 rdma_nl_rcv+0x12/0x20 [ib_core]
 netlink_unicast+0x255/0x380
 ? __alloc_skb+0xfa/0x1e0
 netlink_sendmsg+0x1f3/0x420
 __sock_sendmsg+0x38/0x60
 ____sys_sendmsg+0x1e8/0x230
 ? copy_msghdr_from_user+0xea/0x170
 ___sys_sendmsg+0x7c/0xb0
 ? __futex_wait+0x95/0xf0
 ? __futex_wake_mark+0x40/0x40
 ? futex_wait+0x67/0x100
 ? futex_wake+0xac/0x1b0
 __sys_sendmsg+0x5f/0xb0
 do_syscall_64+0x55/0xb90
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-92512",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "lessThan": "2ef2ea52ae41bd9efa83139e97ae839de7e17156",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "lessThan": "a608af8cde3dd38936b356bbdeedea0653a05b3f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "lessThan": "8998829739c31fdbc892078e4449887d902e5dc9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "lessThan": "038cf231b7099ba6202dcc0c1ea01525122df09f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "lessThan": "001383248e5d754bbddb7ae2a8573bc8501c85d8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "lessThan": "709ba0e5311bd034eb4d9c1c00cc4e1109d6dc3e",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/infiniband/core/verbs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/infiniband/core/verbs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:53.990",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/001383248e5d754bbddb7ae2a8573bc8501c85d8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/038cf231b7099ba6202dcc0c1ea01525122df09f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2ef2ea52ae41bd9efa83139e97ae839de7e17156",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/709ba0e5311bd034eb4d9c1c00cc4e1109d6dc3e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8998829739c31fdbc892078e4449887d902e5dc9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a608af8cde3dd38936b356bbdeedea0653a05b3f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix use after free in ib_query_qp()\n\nWhen querying a QP via the netlink flow the only synchronization\nmechanism for the said QP is rdma_restrack_get(), meanwhile during the\nQP destroy path rdma_restrack_del() is called at the end of the\nib_destroy_qp_user() function which is too late, since by then the\nvendor specific resources for said QP would already be destroyed, and\ntill the rdma_restrack_del() is called this QP can still be accessed,\nwhich could cause the use after free below.\n\nFix this by moving the rdma_restrack_begin_del() to the start of the\nib_destroy_qp_user(), which in turn waits for all usages of the QP to be\ndone then removes it from the database to prevent access to it while it\nis being destroyed.\n\nRIP: 0010:ib_query_qp+0x15/0x50 [ib_core]\nCode: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 <48> 8b 07 48 8b 80 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff\nRSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370\nRDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000\nRBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004\nR10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370\nR13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c\nFS:  00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0\nCall Trace:\n <TASK>\n mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib]\n mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib]\n ib_query_qp+0x35/0x50 [ib_core]\n fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core]\n ? __wake_up+0x40/0x50\n ? netlink_broadcast_filtered+0x15a/0x550\n ? kobject_uevent_env+0x562/0x710\n ? ep_poll_callback+0x242/0x270\n ? __nla_put+0xc/0x20\n ? nla_put+0x28/0x40\n ? nla_put_string+0x2e/0x40 [ib_core]\n fill_res_qp_entry+0x138/0x190 [ib_core]\n res_get_common_dumpit+0x4a5/0x800 [ib_core]\n ? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core]\n nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core]\n netlink_dump+0x16f/0x450\n __netlink_dump_start+0x1ce/0x2e0\n rdma_nl_rcv_msg+0x1d3/0x330 [ib_core]\n ? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core]\n rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core]\n rdma_nl_rcv+0x12/0x20 [ib_core]\n netlink_unicast+0x255/0x380\n ? __alloc_skb+0xfa/0x1e0\n netlink_sendmsg+0x1f3/0x420\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x1e8/0x230\n ? copy_msghdr_from_user+0xea/0x170\n ___sys_sendmsg+0x7c/0xb0\n ? __futex_wait+0x95/0xf0\n ? __futex_wake_mark+0x40/0x40\n ? futex_wait+0x67/0x100\n ? futex_wake+0xac/0x1b0\n __sys_sendmsg+0x5f/0xb0\n do_syscall_64+0x55/0xb90\n entry_SYSCALL_64_after_hwframe+0x4b/0x53"
    }
  ],
  "lastModified": "2026-09-17T17:17:53.990",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}