CVE-2026-92488 (GCVE-0-2026-92488)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:10 – Updated: 2026-09-18 17:55
VLAI
Title
RDMA/erdma: complete object teardown when the destroy command fails
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed, leaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN identifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and permanently disables the command queue, so no retry can succeed; the RDMA core keeps the object after a failed destructor and forced uverbs cleanup then nulls the pointers, making the resources unreachable. Warn on failure but release every software-owned resource and return success, since during terminal destruction the hardware command result is only diagnostic.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 155055771704f8cbb5c176a4309b7dc30a50450c , < 5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabe (git)
Affected: 155055771704f8cbb5c176a4309b7dc30a50450c , < ce7d205c264665517c25e8a3231cf2d0c2443e3c (git)
Affected: 155055771704f8cbb5c176a4309b7dc30a50450c , < 334145d683ad3e31d052247f10807f2ebc950351 (git)
Affected: 155055771704f8cbb5c176a4309b7dc30a50450c , < 652befcba956ef357f480525ccbe25c59bc81d4d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/erdma/erdma_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabe",
              "status": "affected",
              "version": "155055771704f8cbb5c176a4309b7dc30a50450c",
              "versionType": "git"
            },
            {
              "lessThan": "ce7d205c264665517c25e8a3231cf2d0c2443e3c",
              "status": "affected",
              "version": "155055771704f8cbb5c176a4309b7dc30a50450c",
              "versionType": "git"
            },
            {
              "lessThan": "334145d683ad3e31d052247f10807f2ebc950351",
              "status": "affected",
              "version": "155055771704f8cbb5c176a4309b7dc30a50450c",
              "versionType": "git"
            },
            {
              "lessThan": "652befcba956ef357f480525ccbe25c59bc81d4d",
              "status": "affected",
              "version": "155055771704f8cbb5c176a4309b7dc30a50450c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/erdma/erdma_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/erdma: complete object teardown when the destroy command fails\n\nerdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and\nerdma_destroy_ah() returned early when erdma_post_cmd_wait() failed,\nleaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN\nidentifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and\npermanently disables the command queue, so no retry can succeed; the RDMA\ncore keeps the object after a failed destructor and forced uverbs cleanup\nthen nulls the pointers, making the resources unreachable.\n\nWarn on failure but release every software-owned resource and return\nsuccess, since during terminal destruction the hardware command result is\nonly diagnostic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached from ib_uverbs_write(IB_USER_VERBS_CMD_DESTROY_QP/DESTROY_CQ/DEREG_MR/DESTROY_AH) or ib_uverbs_ioctl(UVERBS_METHOD_*_DESTROY) on /dev/infiniband/uverbs*, which call uobj_destroy -\u003e ib_destroy_qp_user/ib_destroy_cq_user/ib_dereg_mr_user -\u003e erdma_destroy_*; a remote RoCE/iWARP peer never supplies that destroy command.\nAC:H - erdma_destroy_qp/cq/ah and erdma_dereg_mr only skip teardown when erdma_post_cmd_wait() fails. That wait returns -ETIME after ERDMA_CMDQ_TIMEOUT_MS and then clears ERDMA_CMDQ_STATE_OK_BIT, or -EIO on a hardware syndrome; the SQE is built by the driver from the kernel-owned QPN/CQN/lkey/AHN, so the attacker cannot force that failure.\nPR:L - ib_uverbs_open() only checks rdma_dev_access_netns() and uverbs_devnode() sets mode 0666. erdma_alloc_ucontext() requires CAP_SYS_RAWIO only when ERDMA_DEV_CAP_FLAGS_EXTEND_DB is unset; on extend-doorbell hardware an unprivileged local user can GET_CONTEXT, CREATE_QP/CQ and then hit the failing destructors.\nUI:N - The attacker issues DESTROY_* on their own uverbs fd or closes it so ib_uverbs_close() runs uverbs_destroy_ufile_hw(); no other user must mount a filesystem, open a file, or otherwise cooperate.\nS:U - A leftover erdma_cq/erdma_qp in cq_xa/qp_xa and a UAF of the associated ib_ucq_object stay inside the host kernel; this is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - On command failure erdma_destroy_cq() returns before xa_erase(\u0026dev-\u003ecq_xa). __uverbs_cleanup_ufile(RDMA_REMOVE_DRIVER_FAILURE) then nulls uobj-\u003eobject without ib_destroy_cq_user and frees the ib_ucq_object, so erdma_ceq_completion_handler() -\u003e ib_uverbs_comp_handler() reads the freed cq-\u003euobject.\nI:H - The same ib_uverbs_comp_handler() then list_add_tail()s onto the freed ev_queue-\u003eevent_list and ib_ucq_object.comp_list after DRIVER_FAILURE dropped the uobject, a use-after-free write into slab memory that can corrupt a reused object or freelist metadata.\nA:H - The CEQ tasklet UAF in ib_uverbs_comp_handler() can oops; independently, returning before erdma_free_idx()/put_mtt_entries()/dma_free_coherent() leaks STAG/QPN/CQN/AHN IDs and DMA queue buffers, and a cmdq timeout permanently disables further commands."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:55:26.825Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabe"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce7d205c264665517c25e8a3231cf2d0c2443e3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/334145d683ad3e31d052247f10807f2ebc950351"
        },
        {
          "url": "https://git.kernel.org/stable/c/652befcba956ef357f480525ccbe25c59bc81d4d"
        }
      ],
      "title": "RDMA/erdma: complete object teardown when the destroy command fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-92488",
    "datePublished": "2026-09-17T16:10:02.962Z",
    "dateReserved": "2026-09-16T12:21:13.870Z",
    "dateUpdated": "2026-09-18T17:55:26.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-92488",
      "date": "2026-09-29",
      "epss": "0.00155",
      "percentile": "0.03937"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/erdma/erdma_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabe",
                    "status": "affected",
                    "version": "155055771704f8cbb5c176a4309b7dc30a50450c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ce7d205c264665517c25e8a3231cf2d0c2443e3c",
                    "status": "affected",
                    "version": "155055771704f8cbb5c176a4309b7dc30a50450c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "334145d683ad3e31d052247f10807f2ebc950351",
                    "status": "affected",
                    "version": "155055771704f8cbb5c176a4309b7dc30a50450c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "652befcba956ef357f480525ccbe25c59bc81d4d",
                    "status": "affected",
                    "version": "155055771704f8cbb5c176a4309b7dc30a50450c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/erdma/erdma_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.0"
                  },
                  {
                    "lessThan": "6.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/erdma: complete object teardown when the destroy command fails\n\nerdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and\nerdma_destroy_ah() returned early when erdma_post_cmd_wait() failed,\nleaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN\nidentifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and\npermanently disables the command queue, so no retry can succeed; the RDMA\ncore keeps the object after a failed destructor and forced uverbs cleanup\nthen nulls the pointers, making the resources unreachable.\n\nWarn on failure but release every software-owned resource and return\nsuccess, since during terminal destruction the hardware command result is\nonly diagnostic."
          }
        ],
        "id": "CVE-2026-92488",
        "lastModified": "2026-09-18T18:18:12.893",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:50.900",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/334145d683ad3e31d052247f10807f2ebc950351"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/652befcba956ef357f480525ccbe25c59bc81d4d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ce7d205c264665517c25e8a3231cf2d0c2443e3c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:27:04Z",
      "cve": "CVE-2026-92488",
      "id": "CVE-2026-92488",
      "initial_release_date": "2026-09-22T16:27:04Z",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-92488",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-92488.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.