222 lines
13 KiB
JSON
222 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-92510",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-16T12:21:13.872Z",
|
|
"datePublished": "2026-09-17T16:10:20.775Z",
|
|
"dateUpdated": "2026-10-19T09:04:16.292Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T09:04:16.292Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix potential use after free in ib_destroy_srq_user()\n\nWhen accessing a SRQ via the netlink path the only synchronization\nmechanism for the said SRQ is rdma_restrack_get().\nCurrently, rdma_restrack_del() is invoked at the end of\nib_destroy_srq_user(), which is too late, since by that point\nvendor-specific resources associated with the SRQ might already be\nfreed. This can leave a short window where the SRQ remains accessible\nthrough restrack, leading to a potential use-after-free.\n\nFix this by moving the rdma_restrack_begin_del() call to the start of\nib_destroy_srq_user(), ensuring that the SRQ is removed from restrack\nbefore its internal resources are released. This guarantees that no new\nusers hold references to a SRQ that is in the process of destruction.\n\nIn addition, this change preserves the intended inverted order\nbetween create and destroy routines: resources are added to\nrestrack at the end of successful creation, and hence shall be removed\nfrom the restrack first thing during the destruction flow, which keeps\nthe lifecycle management consistent and predictable."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - Reached by a local write/ioctl on /dev/infiniband/uverbsN (IB_USER_VERBS_CMD_DESTROY_SRQ or UVERBS_METHOD_SRQ_DESTROY → uverbs_free_srq → ib_destroy_srq_user) raced with NETLINK_RDMA RDMA_NLDEV_CMD_RES_SRQ_GET; incoming RoCE/IB packets never invoke destroy_srq or fill_res_srq_entry.\nAC:L - The attacker controls both sides: one thread DESTROY_SRQs the handle while another issues RDMA_NLDEV_CMD_RES_SRQ_GET so nldev_res_get_srq_doit → rdma_restrack_get_byid still finds the SRQ during ops.destroy_srq (e.g. hns_roce_destroy_srq's mailbox and wait_for_completion); no uninfluenced victim state is required.\nPR:L - ib_uverbs_open() has no capable() check and uverbs_devnode() creates /dev/infiniband/uverbs* mode 0666, and RDMA_NLDEV_CMD_RES_SRQ_GET is registered without RDMA_NL_ADMIN_PERM, so an unprivileged local user on a host with an RDMA device can create an SRQ and dump it via nldev.\nUI:N - The attacker opens uverbs, creates the SRQ, and races DESTROY_SRQ with their own NETLINK_RDMA RES_SRQ_GET; no other user must mount, click, or otherwise act.\nS:U - The use-after-free is of the host-kernel ib_srq and its vendor SRQ resources inside ib_core; it does not escape a VM, bypass an IOMMU, or otherwise leave the kernel's authority.\nC:H - After ops.destroy_srq frees vendor state (hns free_srqc/free_srq_buf, rxe_srq_cleanup→rxe_queue_cleanup, bnxt_qplib_destroy_srq kfree(swq)), the SRQ is still in restrack so fill_res_srq_entry/fill_res_srq_entry_raw (hns query_srqc, bnxt_qplib_read_context) read the freed object, a UAF disclosure primitive.\nI:H - The same UAF leaves vendor SRQ allocations (bnxt swq, siw recvq, rxe queue, mlx5 umem) freed while nldev still holds the restrack kref in fill_res_srq_entry, so heap reuse of those objects yields a write/control-flow primitive.\nA:H - fill_res_srq_entry walking an SRQ whose vendor buffers were already released by destroy_srq (kfree/vfree of swq, recvq, or rxe queue) can oops the kernel, so availability impact is high even without a full exploit."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/infiniband/core/verbs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "48f8a70e899fa4d9c8f00369f482f0382173ece9",
|
|
"lessThan": "a5bfd9fe05d5cebbd3e447bf7f7b2c663007d8b9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "48f8a70e899fa4d9c8f00369f482f0382173ece9",
|
|
"lessThan": "d3d0eabe6e39b024deb3e085e2d408d037e967c3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "48f8a70e899fa4d9c8f00369f482f0382173ece9",
|
|
"lessThan": "9c704383529044c02122f85a2a9a42cbf14a07a6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "48f8a70e899fa4d9c8f00369f482f0382173ece9",
|
|
"lessThan": "bedd7dee72588c838f5b67197ea8b387e7beb918",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "48f8a70e899fa4d9c8f00369f482f0382173ece9",
|
|
"lessThan": "95c992c869df54a6a7061f5f3fb6400244f2af8f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "48f8a70e899fa4d9c8f00369f482f0382173ece9",
|
|
"lessThan": "88244ecc71cc0b3ed200f5ef7ddea6686adfd730",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/infiniband/core/verbs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.13",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.13",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.188",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.157",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.110",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.52",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.6",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "6.1.188"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "6.6.157"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "6.12.110"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "6.18.52"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "7.2.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a5bfd9fe05d5cebbd3e447bf7f7b2c663007d8b9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d3d0eabe6e39b024deb3e085e2d408d037e967c3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9c704383529044c02122f85a2a9a42cbf14a07a6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bedd7dee72588c838f5b67197ea8b387e7beb918"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/95c992c869df54a6a7061f5f3fb6400244f2af8f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/88244ecc71cc0b3ed200f5ef7ddea6686adfd730"
|
|
}
|
|
],
|
|
"title": "RDMA/core: Fix potential use after free in ib_destroy_srq_user()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |