CVE-2026-92509RDMA/core: Fix potential use after free in counter_release()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counter_release() When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of counter_release(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 99fa331dc8629be55ac7a0cca0dc56492070ddac builds before 5eb0c57a8b568eb08f464861d84d518a2af939ac; from 99fa331dc8629be55ac7a0cca0dc56492070ddac before d5cc211e8c39e46f357d30a092d683e84d560de9; 99fa331dc8629be55ac7a0cca0dc56492070ddac builds before 2f0c6705e26ba92c0c6b0b0908a2d3f35a039d5b; 99fa331dc8629be55ac7a0cca0dc56492070ddac builds before 8c013e3a8d8273da4d47bf1c27f016a3551996f5; 99fa331dc8629be55ac7a0cca0dc56492070ddac builds before 64c72390d8407ea86de712a477c796b07d37abc4; from 99fa331dc8629be55ac7a0cca0dc56492070ddac before 235ef2d0e750885c29340b0fc40620a7a4f52e12 | CNA record |
References
- https://git.kernel.org/stable/c/5eb0c57a8b568eb08f464861d84d518a2af939ac
- https://git.kernel.org/stable/c/d5cc211e8c39e46f357d30a092d683e84d560de9
- https://git.kernel.org/stable/c/2f0c6705e26ba92c0c6b0b0908a2d3f35a039d5b
- https://git.kernel.org/stable/c/8c013e3a8d8273da4d47bf1c27f016a3551996f5
- https://git.kernel.org/stable/c/64c72390d8407ea86de712a477c796b07d37abc4
- https://git.kernel.org/stable/c/235ef2d0e750885c29340b0fc40620a7a4f52e12
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.