CVE-2026-92509

RDMA/core: Fix potential use after free in counter_release()

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix potential use after free in counter_release()

When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of counter_release(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free.

Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	99fa331dc8629be55ac7a0cca0dc56492070ddac to before 5eb0c57a8b568eb08f464861d84d518a2af939acAffected 99fa331dc8629be55ac7a0cca0dc56492070ddac to before d5cc211e8c39e46f357d30a092d683e84d560de9Affected 99fa331dc8629be55ac7a0cca0dc56492070ddac to before 2f0c6705e26ba92c0c6b0b0908a2d3f35a039d5bAffected 99fa331dc8629be55ac7a0cca0dc56492070ddac to before 8c013e3a8d8273da4d47bf1c27f016a3551996f5Affected 99fa331dc8629be55ac7a0cca0dc56492070ddac to before 64c72390d8407ea86de712a477c796b07d37abc4Affected 99fa331dc8629be55ac7a0cca0dc56492070ddac to before 235ef2d0e750885c29340b0fc40620a7a4f52e12Affected
LinuxLinux	5.3Affected before 5.3Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

99fa331dc8629be55ac7a0cca0dc56492070ddac to before 5eb0c57a8b568eb08f464861d84d518a2af939acAffected
99fa331dc8629be55ac7a0cca0dc56492070ddac to before d5cc211e8c39e46f357d30a092d683e84d560de9Affected
99fa331dc8629be55ac7a0cca0dc56492070ddac to before 2f0c6705e26ba92c0c6b0b0908a2d3f35a039d5bAffected
99fa331dc8629be55ac7a0cca0dc56492070ddac to before 8c013e3a8d8273da4d47bf1c27f016a3551996f5Affected
99fa331dc8629be55ac7a0cca0dc56492070ddac to before 64c72390d8407ea86de712a477c796b07d37abc4Affected
99fa331dc8629be55ac7a0cca0dc56492070ddac to before 235ef2d0e750885c29340b0fc40620a7a4f52e12Affected

LinuxLinux

5.3Affected
before 5.3Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.