CVE-2026-92512 (GCVE-0-2026-92512)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:10 – Updated: 2026-09-17 16:10
VLAI
Title
RDMA/core: Fix use after free in ib_query_qp()
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ib_query_qp() When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdma_restrack_get(), meanwhile during the QP destroy path rdma_restrack_del() is called at the end of the ib_destroy_qp_user() function which is too late, since by then the vendor specific resources for said QP would already be destroyed, and till the rdma_restrack_del() is called this QP can still be accessed, which could cause the use after free below. Fix this by moving the rdma_restrack_begin_del() to the start of the ib_destroy_qp_user(), which in turn waits for all usages of the QP to be done then removes it from the database to prevent access to it while it is being destroyed. RIP: 0010:ib_query_qp+0x15/0x50 [ib_core] Code: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 <48> 8b 07 48 8b 80 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff RSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370 RDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000 RBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004 R10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370 R13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c FS: 00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0 Call Trace: <TASK> mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib] mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib] ib_query_qp+0x35/0x50 [ib_core] fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core] ? __wake_up+0x40/0x50 ? netlink_broadcast_filtered+0x15a/0x550 ? kobject_uevent_env+0x562/0x710 ? ep_poll_callback+0x242/0x270 ? __nla_put+0xc/0x20 ? nla_put+0x28/0x40 ? nla_put_string+0x2e/0x40 [ib_core] fill_res_qp_entry+0x138/0x190 [ib_core] res_get_common_dumpit+0x4a5/0x800 [ib_core] ? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core] nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core] netlink_dump+0x16f/0x450 __netlink_dump_start+0x1ce/0x2e0 rdma_nl_rcv_msg+0x1d3/0x330 [ib_core] ? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core] rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core] rdma_nl_rcv+0x12/0x20 [ib_core] netlink_unicast+0x255/0x380 ? __alloc_skb+0xfa/0x1e0 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x230 ? copy_msghdr_from_user+0xea/0x170 ___sys_sendmsg+0x7c/0xb0 ? __futex_wait+0x95/0xf0 ? __futex_wake_mark+0x40/0x40 ? futex_wait+0x67/0x100 ? futex_wake+0xac/0x1b0 __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xb90 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 514aee660df493cd673154a6ba6bab745ec47b8c , < 2ef2ea52ae41bd9efa83139e97ae839de7e17156 (git)
Affected: 514aee660df493cd673154a6ba6bab745ec47b8c , < a608af8cde3dd38936b356bbdeedea0653a05b3f (git)
Affected: 514aee660df493cd673154a6ba6bab745ec47b8c , < 8998829739c31fdbc892078e4449887d902e5dc9 (git)
Affected: 514aee660df493cd673154a6ba6bab745ec47b8c , < 038cf231b7099ba6202dcc0c1ea01525122df09f (git)
Affected: 514aee660df493cd673154a6ba6bab745ec47b8c , < 001383248e5d754bbddb7ae2a8573bc8501c85d8 (git)
Affected: 514aee660df493cd673154a6ba6bab745ec47b8c , < 709ba0e5311bd034eb4d9c1c00cc4e1109d6dc3e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ef2ea52ae41bd9efa83139e97ae839de7e17156",
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "versionType": "git"
            },
            {
              "lessThan": "a608af8cde3dd38936b356bbdeedea0653a05b3f",
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "versionType": "git"
            },
            {
              "lessThan": "8998829739c31fdbc892078e4449887d902e5dc9",
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "versionType": "git"
            },
            {
              "lessThan": "038cf231b7099ba6202dcc0c1ea01525122df09f",
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "versionType": "git"
            },
            {
              "lessThan": "001383248e5d754bbddb7ae2a8573bc8501c85d8",
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "versionType": "git"
            },
            {
              "lessThan": "709ba0e5311bd034eb4d9c1c00cc4e1109d6dc3e",
              "status": "affected",
              "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix use after free in ib_query_qp()\n\nWhen querying a QP via the netlink flow the only synchronization\nmechanism for the said QP is rdma_restrack_get(), meanwhile during the\nQP destroy path rdma_restrack_del() is called at the end of the\nib_destroy_qp_user() function which is too late, since by then the\nvendor specific resources for said QP would already be destroyed, and\ntill the rdma_restrack_del() is called this QP can still be accessed,\nwhich could cause the use after free below.\n\nFix this by moving the rdma_restrack_begin_del() to the start of the\nib_destroy_qp_user(), which in turn waits for all usages of the QP to be\ndone then removes it from the database to prevent access to it while it\nis being destroyed.\n\nRIP: 0010:ib_query_qp+0x15/0x50 [ib_core]\nCode: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 \u003c48\u003e 8b 07 48 8b 80 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff\nRSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370\nRDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000\nRBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004\nR10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370\nR13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c\nFS:  00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0\nCall Trace:\n \u003cTASK\u003e\n mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib]\n mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib]\n ib_query_qp+0x35/0x50 [ib_core]\n fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core]\n ? __wake_up+0x40/0x50\n ? netlink_broadcast_filtered+0x15a/0x550\n ? kobject_uevent_env+0x562/0x710\n ? ep_poll_callback+0x242/0x270\n ? __nla_put+0xc/0x20\n ? nla_put+0x28/0x40\n ? nla_put_string+0x2e/0x40 [ib_core]\n fill_res_qp_entry+0x138/0x190 [ib_core]\n res_get_common_dumpit+0x4a5/0x800 [ib_core]\n ? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core]\n nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core]\n netlink_dump+0x16f/0x450\n __netlink_dump_start+0x1ce/0x2e0\n rdma_nl_rcv_msg+0x1d3/0x330 [ib_core]\n ? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core]\n rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core]\n rdma_nl_rcv+0x12/0x20 [ib_core]\n netlink_unicast+0x255/0x380\n ? __alloc_skb+0xfa/0x1e0\n netlink_sendmsg+0x1f3/0x420\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x1e8/0x230\n ? copy_msghdr_from_user+0xea/0x170\n ___sys_sendmsg+0x7c/0xb0\n ? __futex_wait+0x95/0xf0\n ? __futex_wake_mark+0x40/0x40\n ? futex_wait+0x67/0x100\n ? futex_wake+0xac/0x1b0\n __sys_sendmsg+0x5f/0xb0\n do_syscall_64+0x55/0xb90\n entry_SYSCALL_64_after_hwframe+0x4b/0x53"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:10:22.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ef2ea52ae41bd9efa83139e97ae839de7e17156"
        },
        {
          "url": "https://git.kernel.org/stable/c/a608af8cde3dd38936b356bbdeedea0653a05b3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8998829739c31fdbc892078e4449887d902e5dc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/038cf231b7099ba6202dcc0c1ea01525122df09f"
        },
        {
          "url": "https://git.kernel.org/stable/c/001383248e5d754bbddb7ae2a8573bc8501c85d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/709ba0e5311bd034eb4d9c1c00cc4e1109d6dc3e"
        }
      ],
      "title": "RDMA/core: Fix use after free in ib_query_qp()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-92512",
    "datePublished": "2026-09-17T16:10:22.114Z",
    "dateReserved": "2026-09-16T12:21:13.873Z",
    "dateUpdated": "2026-09-17T16:10:22.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-92512",
      "date": "2026-09-29",
      "epss": "0.00215",
      "percentile": "0.10616"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/core/verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2ef2ea52ae41bd9efa83139e97ae839de7e17156",
                    "status": "affected",
                    "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a608af8cde3dd38936b356bbdeedea0653a05b3f",
                    "status": "affected",
                    "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8998829739c31fdbc892078e4449887d902e5dc9",
                    "status": "affected",
                    "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "038cf231b7099ba6202dcc0c1ea01525122df09f",
                    "status": "affected",
                    "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "001383248e5d754bbddb7ae2a8573bc8501c85d8",
                    "status": "affected",
                    "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "709ba0e5311bd034eb4d9c1c00cc4e1109d6dc3e",
                    "status": "affected",
                    "version": "514aee660df493cd673154a6ba6bab745ec47b8c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/core/verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix use after free in ib_query_qp()\n\nWhen querying a QP via the netlink flow the only synchronization\nmechanism for the said QP is rdma_restrack_get(), meanwhile during the\nQP destroy path rdma_restrack_del() is called at the end of the\nib_destroy_qp_user() function which is too late, since by then the\nvendor specific resources for said QP would already be destroyed, and\ntill the rdma_restrack_del() is called this QP can still be accessed,\nwhich could cause the use after free below.\n\nFix this by moving the rdma_restrack_begin_del() to the start of the\nib_destroy_qp_user(), which in turn waits for all usages of the QP to be\ndone then removes it from the database to prevent access to it while it\nis being destroyed.\n\nRIP: 0010:ib_query_qp+0x15/0x50 [ib_core]\nCode: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 \u003c48\u003e 8b 07 48 8b 80 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff\nRSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370\nRDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000\nRBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004\nR10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370\nR13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c\nFS:  00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0\nCall Trace:\n \u003cTASK\u003e\n mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib]\n mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib]\n ib_query_qp+0x35/0x50 [ib_core]\n fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core]\n ? __wake_up+0x40/0x50\n ? netlink_broadcast_filtered+0x15a/0x550\n ? kobject_uevent_env+0x562/0x710\n ? ep_poll_callback+0x242/0x270\n ? __nla_put+0xc/0x20\n ? nla_put+0x28/0x40\n ? nla_put_string+0x2e/0x40 [ib_core]\n fill_res_qp_entry+0x138/0x190 [ib_core]\n res_get_common_dumpit+0x4a5/0x800 [ib_core]\n ? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core]\n nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core]\n netlink_dump+0x16f/0x450\n __netlink_dump_start+0x1ce/0x2e0\n rdma_nl_rcv_msg+0x1d3/0x330 [ib_core]\n ? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core]\n rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core]\n rdma_nl_rcv+0x12/0x20 [ib_core]\n netlink_unicast+0x255/0x380\n ? __alloc_skb+0xfa/0x1e0\n netlink_sendmsg+0x1f3/0x420\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x1e8/0x230\n ? copy_msghdr_from_user+0xea/0x170\n ___sys_sendmsg+0x7c/0xb0\n ? __futex_wait+0x95/0xf0\n ? __futex_wake_mark+0x40/0x40\n ? futex_wait+0x67/0x100\n ? futex_wake+0xac/0x1b0\n __sys_sendmsg+0x5f/0xb0\n do_syscall_64+0x55/0xb90\n entry_SYSCALL_64_after_hwframe+0x4b/0x53"
          }
        ],
        "id": "CVE-2026-92512",
        "lastModified": "2026-09-17T17:17:53.990",
        "metrics": {},
        "published": "2026-09-17T17:17:53.990",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/001383248e5d754bbddb7ae2a8573bc8501c85d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/038cf231b7099ba6202dcc0c1ea01525122df09f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2ef2ea52ae41bd9efa83139e97ae839de7e17156"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/709ba0e5311bd034eb4d9c1c00cc4e1109d6dc3e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8998829739c31fdbc892078e4449887d902e5dc9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a608af8cde3dd38936b356bbdeedea0653a05b3f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:26:28Z",
      "cve": "CVE-2026-92512",
      "id": "CVE-2026-92512",
      "initial_release_date": "2026-09-18T00:13:23Z",
      "product_status:known_affected": "133",
      "product_status:known_not_affected": "214",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-92512",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-92512.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.