CVE-2026-92488

RDMA/erdma: complete object teardown when the destroy command fails

State: Published
Severity: 7.0 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: complete object teardown when the destroy command fails

erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed, leaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN identifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and permanently disables the command queue, so no retry can succeed; the RDMA core keeps the object after a failed destructor and forced uverbs cleanup then nulls the pointers, making the resources unreachable.

Warn on failure but release every software-owned resource and return success, since during terminal destruction the hardware command result is only diagnostic.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	155055771704f8cbb5c176a4309b7dc30a50450c to before 4f5cd6a2081ec956db25b8e9f71d052f68d522c7Affected 155055771704f8cbb5c176a4309b7dc30a50450c to before 3886d944b506e0cc681646beb03c3024cb375a68Affected 155055771704f8cbb5c176a4309b7dc30a50450c to before 5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabeAffected 155055771704f8cbb5c176a4309b7dc30a50450c to before ce7d205c264665517c25e8a3231cf2d0c2443e3cAffected 155055771704f8cbb5c176a4309b7dc30a50450c to before 334145d683ad3e31d052247f10807f2ebc950351Affected 155055771704f8cbb5c176a4309b7dc30a50450c to before 652befcba956ef357f480525ccbe25c59bc81d4dAffected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

155055771704f8cbb5c176a4309b7dc30a50450c to before 4f5cd6a2081ec956db25b8e9f71d052f68d522c7Affected
155055771704f8cbb5c176a4309b7dc30a50450c to before 3886d944b506e0cc681646beb03c3024cb375a68Affected
155055771704f8cbb5c176a4309b7dc30a50450c to before 5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabeAffected
155055771704f8cbb5c176a4309b7dc30a50450c to before ce7d205c264665517c25e8a3231cf2d0c2443e3cAffected
155055771704f8cbb5c176a4309b7dc30a50450c to before 334145d683ad3e31d052247f10807f2ebc950351Affected
155055771704f8cbb5c176a4309b7dc30a50450c to before 652befcba956ef357f480525ccbe25c59bc81d4dAffected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.