CVE-2026-92511 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux systems that utilize RDMA functionality, especially those responsible for vulnerability management, security teams, and operators of affected platforms. They should review the vulnerability details, assess exposure, and prioritize remediation for systems using the affected kernel versions.

Why it matters

A use-after-free vulnerability in the Linux kernel's RDMA/core subsystem requires attention from Linux kernel developers, maintainers, and users. The vulnerability's impact and exploitation are not confirmed, but its potential consequences necessitate prompt assessment and remediation.

• Potential use-after-free exploitation requires verification
• Remediation priority for systems using affected kernel versions
• Monitoring and exception tracking for suspicious RDMA activity

Technical summary

The vulnerability is caused by the incorrect synchronization of CQ destruction with its potential use through the netlink path. The fix involves moving the rdma_restrack_begin_del() call to the start of ib_destroy_cq_user(), ensuring that the CQ is removed from restrack before its internal resources are released. This change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to fix the vulnerability
• Monitor Linux kernel updates for potential related vulnerabilities
• Assess exposure and prioritize remediation for systems using the affected kernel versions
• Perform compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.