CVE-2026-92513

CVE CVE-2026-92513EUVD EUVD-2026-82134Published 2026-09-17T16:10:22.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: drain QP references after partial table insertion mana_table_store_ud_qp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xa_insert_irq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free. Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 0; 8001e9257eca23264550ff9e34598ee43a80f0f9 <638b9a5364c1482e5d104823c1a3884b3d249484; patch: 6.18.52; 6.15; 8001e9257eca23264550ff9e34598ee43a80f0f9 <97f7c2262c28ebcae64fc957ee978646684a5ed9; patch: 7.2.6; 8001e9257eca23264550ff9e34598ee43a80f0f9 <4aaa2ab816c710be7385b31d08373edcdcd71656; patch: 7.3-rc1

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.