FKIE_CVE-2026-92509

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counter_release() When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of counter_release(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/235ef2d0e750885c29340b0fc40620a7a4f52e12
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2f0c6705e26ba92c0c6b0b0908a2d3f35a039d5b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5eb0c57a8b568eb08f464861d84d518a2af939ac
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/64c72390d8407ea86de712a477c796b07d37abc4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8c013e3a8d8273da4d47bf1c27f016a3551996f5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d5cc211e8c39e46f357d30a092d683e84d560de9
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/counters.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5eb0c57a8b568eb08f464861d84d518a2af939ac",
              "status": "affected",
              "version": "99fa331dc8629be55ac7a0cca0dc56492070ddac",
              "versionType": "git"
            },
            {
              "lessThan": "d5cc211e8c39e46f357d30a092d683e84d560de9",
              "status": "affected",
              "version": "99fa331dc8629be55ac7a0cca0dc56492070ddac",
              "versionType": "git"
            },
            {
              "lessThan": "2f0c6705e26ba92c0c6b0b0908a2d3f35a039d5b",
              "status": "affected",
              "version": "99fa331dc8629be55ac7a0cca0dc56492070ddac",
              "versionType": "git"
            },
            {
              "lessThan": "8c013e3a8d8273da4d47bf1c27f016a3551996f5",
              "status": "affected",
              "version": "99fa331dc8629be55ac7a0cca0dc56492070ddac",
              "versionType": "git"
            },
            {
              "lessThan": "64c72390d8407ea86de712a477c796b07d37abc4",
              "status": "affected",
              "version": "99fa331dc8629be55ac7a0cca0dc56492070ddac",
              "versionType": "git"
            },
            {
              "lessThan": "235ef2d0e750885c29340b0fc40620a7a4f52e12",
              "status": "affected",
              "version": "99fa331dc8629be55ac7a0cca0dc56492070ddac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/counters.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix potential use after free in counter_release()\n\nWhen accessing a counter via the netlink path the only synchronization\nmechanism for the said counter is rdma_restrack_get().\nCurrently, rdma_restrack_del() is invoked at the end of\ncounter_release(), which is too late, since by that point\nvendor-specific resources associated with the counter might already be\nfreed. This can leave a short window where the counter remains\naccessible through restrack, leading to a potential use-after-free.\n\nFix this by moving the rdma_restrack_del() call to be before the\nfreeing of the vendor-specific resources, ensuring that the counter is\nremoved from restrack before its internal resources are released.\nThis guarantees that no new users hold references to a counter that is\nin the process of destruction."
    }
  ],
  "id": "CVE-2026-92509",
  "lastModified": "2026-09-17T17:17:53.590",
  "metrics": {},
  "published": "2026-09-17T17:17:53.590",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/235ef2d0e750885c29340b0fc40620a7a4f52e12"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2f0c6705e26ba92c0c6b0b0908a2d3f35a039d5b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5eb0c57a8b568eb08f464861d84d518a2af939ac"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/64c72390d8407ea86de712a477c796b07d37abc4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8c013e3a8d8273da4d47bf1c27f016a3551996f5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d5cc211e8c39e46f357d30a092d683e84d560de9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.