{"id":"CVE-2026-92513","revision":"3394e9c06ab142d2bc2aecb52724c29d","records":[{"revision":"3394e9c06ab142d2bc2aecb52724c29d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92513","aliases":[],"title":"RDMA/mana_ib: drain QP references after partial table insertion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: drain QP references after partial table insertion\n\nmana_table_store_ud_qp() publishes a QP at its send-queue id before\ninserting the receive-queue id, dropping the XArray lock between the two\nxa_insert_irq() calls. A concurrent completion handler can look up the QP\nand take a transient reference. When the second insertion fails, the\nrollback erased only the send-queue entry and returned, leaving both the\ninitial table reference and the transient reference outstanding while RDMA\ncore frees the QP, causing a use-after-free.\n\nDrain the reference as normal destruction does: drop the initial reference\nand wait for qp->free, releasing the QP only after every concurrent lookup\nreturns its reference.","state":0,"publishedAt":"2026-09-17T16:10:22.793+00:00","modifiedAt":"2026-10-19T09:04:19.875+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/infiniband/hw/mana/qp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8001e9257eca23264550ff9e34598ee43a80f0f9\",\n                            \"lessThan\": \"4aaa2ab816c710be7385b31d08373edcdcd71656\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8001e9257eca23264550ff9e34598ee43a80f0f9\",\n                            \"lessThan\": \"638b9a5364c1482e5d104823c1a3884b3d249484\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8001e9257eca23264550ff9e34598ee43a80f0f9\",\n                            \"lessThan\": \"97f7c2262c28ebcae64fc957ee978646684a5ed9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/infiniband/hw/mana/qp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/4aaa2ab816c710be7385b31d08373edcdcd71656","https://git.kernel.org/stable/c/638b9a5364c1482e5d104823c1a3884b3d249484","https://git.kernel.org/stable/c/97f7c2262c28ebcae64fc957ee978646684a5ed9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92513","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92513","identifiers":["CVE-2026-92513"]},"retained":false,"historicalAffected":[]}],"coverage":[]}