{"id":"CVE-2026-92513","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: drain QP references after partial table insertion\n\nmana_table_store_ud_qp() publishes a QP at its send-queue id before\ninserting the receive-queue id, dro…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: drain QP references after partial table insertion\n\nmana_table_store_ud_qp() publishes a QP at its send-queue id before\ninserting the receive-queue id, dro…","severity":"high","vendor":"Linux","product":"Linux","affected":["Linux >= 8001e9257eca23264550ff9e34598ee43a80f0f9 < 4aaa2ab816c710be7385b31d08373edcdcd71656","Linux >= 8001e9257eca23264550ff9e34598ee43a80f0f9 < 638b9a5364c1482e5d104823c1a3884b3d249484","Linux >= 8001e9257eca23264550ff9e34598ee43a80f0f9 < 97f7c2262c28ebcae64fc957ee978646684a5ed9","Linux 6.15"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:54.140","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92513","references":[{"url":"https://git.kernel.org/stable/c/4aaa2ab816c710be7385b31d08373edcdcd71656","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/638b9a5364c1482e5d104823c1a3884b3d249484","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97f7c2262c28ebcae64fc957ee978646684a5ed9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92513.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-92513"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536549"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92513"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92513"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-92513.mbox"},{"url":"https://kernelcve.org/list/?q=CVE-2026-92513"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ingestedAt":"2026-09-17T16:21:47.778Z","epss":0.00206,"epssPercentile":0.10617,"cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":["CWE-825","CWE-416"],"slug":"CVE-2026-92513","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: drain QP references after partial table insertion\n\nmana_table_store_ud_qp() publishes a QP at its send-queue id before\ninserting the receive-queue id, dropping the XArray lock between the two\nxa_insert_irq() calls. A concurrent completion handler can look up the QP\nand take a transient reference. When the second insertion fails, the\nrollback erased only the send-queue entry and returned, leaving both the\ninitial table reference and the transient reference outstanding while RDMA\ncore frees the QP, causing a use-after-free.\n\nDrain the reference as normal destruction does: drop the initial reference\nand wait for qp->free, releasing the QP only after every concurrent lookup\nreturns its reference.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92513.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225529,"id":"CVE-2026-92513","ts":1792498284806,"field":"cvss","old":null,"new":"7"},{"seq":225528,"id":"CVE-2026-92513","ts":1792498284806,"field":"severity","old":"none","new":"high"}]}