---
id: CVE-2026-92514
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/erdma: Fix CEQ tasklet use-after-free on removal

  Each CEQ interrupt handler only schedules eqc->tasklet
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/erdma: Fix CEQ tasklet use-after-free on removal

  Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls
  erdma_ceq_completion_handler(), which r…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f2a0a630b953451a59a2612ad8c29246638f0a38 <
    0e8b78dabb1f156db05ffe74c6eae861167c7c21
  - >-
    Linux >= f2a0a630b953451a59a2612ad8c29246638f0a38 <
    6e129c1310abfa786a510cc63e69c5ef12349048
  - >-
    Linux >= f2a0a630b953451a59a2612ad8c29246638f0a38 <
    f738c0a372d36a10dfae6dc357717c13b2aa72f4
  - >-
    Linux >= f2a0a630b953451a59a2612ad8c29246638f0a38 <
    a60c36d8d17f1b86705523d5eb6d290df28831e5
  - >-
    Linux >= f2a0a630b953451a59a2612ad8c29246638f0a38 <
    61a25b8d333e1eb2a189881d516f8d5194e26840
  - >-
    Linux >= f2a0a630b953451a59a2612ad8c29246638f0a38 <
    0ca79979384f031d710c4b3bae065dcb5d95aca3
  - Linux 6.0
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:54.243'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92514'
references:
  - url: 'https://git.kernel.org/stable/c/0ca79979384f031d710c4b3bae065dcb5d95aca3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0e8b78dabb1f156db05ffe74c6eae861167c7c21'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/61a25b8d333e1eb2a189881d516f8d5194e26840'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6e129c1310abfa786a510cc63e69c5ef12349048'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a60c36d8d17f1b86705523d5eb6d290df28831e5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f738c0a372d36a10dfae6dc357717c13b2aa72f4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.778Z'
epss: 0.00205
epssPercentile: 0.09473
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Fix CEQ tasklet use-after-free on removal

Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls
erdma_ceq_completion_handler(), which reads the DMA-coherent EQ ring
through get_next_valid_eqe() and updates eq->dbrec through notify_eq().

erdma_ceqs_uninit() frees each CEQ IRQ and then destroys its EQ.
free_irq() prevents another hard IRQ and waits for an in-flight handler,
but it does not drain a tasklet that the handler already scheduled. The
tasklet can therefore access eq->qbuf or eq->dbrec after
erdma_eq_destroy() frees them.

Clearing ceq_cb->ready does not synchronize with a tasklet that already
passed the check at the start of erdma_ceq_completion_handler().

Kill the tasklet after free_irq(), when no handler can schedule it again,
and before erdma_ceq_uninit_one() releases the EQ buffers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.