{"id":"CVE-2026-92513","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: drain QP references after partial table insertion\n\nmana_table_store_ud_qp() publishes a QP at its send-queue id before\ninserting the receive-queue id, dro…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: drain QP references after partial table insertion\n\nmana_table_store_ud_qp() publishes a QP at its send-queue id before\ninserting the receive-queue id, dro…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 8001e9257eca23264550ff9e34598ee43a80f0f9 < 4aaa2ab816c710be7385b31d08373edcdcd71656","Linux >= 8001e9257eca23264550ff9e34598ee43a80f0f9 < 638b9a5364c1482e5d104823c1a3884b3d249484","Linux >= 8001e9257eca23264550ff9e34598ee43a80f0f9 < 97f7c2262c28ebcae64fc957ee978646684a5ed9","Linux 6.15"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:54.140","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92513","references":[{"url":"https://git.kernel.org/stable/c/4aaa2ab816c710be7385b31d08373edcdcd71656","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/638b9a5364c1482e5d104823c1a3884b3d249484","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97f7c2262c28ebcae64fc957ee978646684a5ed9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.778Z","epss":0.00198,"epssPercentile":0.09823,"slug":"CVE-2026-92513","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: drain QP references after partial table insertion\n\nmana_table_store_ud_qp() publishes a QP at its send-queue id before\ninserting the receive-queue id, dropping the XArray lock between the two\nxa_insert_irq() calls. A concurrent completion handler can look up the QP\nand take a transient reference. When the second insertion fails, the\nrollback erased only the send-queue entry and returned, leaving both the\ninitial table reference and the transient reference outstanding while RDMA\ncore frees the QP, causing a use-after-free.\n\nDrain the reference as normal destruction does: drop the initial reference\nand wait for qp->free, releasing the QP only after every concurrent lookup\nreturns its reference.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}