CVE-2026-93267
Received Received - Intake

Use-After-Free in Linux Kernel RDMA Core

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in uverbs_free_dmah() When accessing a dmah via the netlink path the only synchronization mechanism for the said dmah is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of uverbs_free_dmah(), which is too late, since by that point vendor-specific resources associated with the dmah might already be freed. This can leave a short window where the dmah remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of uverbs_free_dmah(), ensuring that the dmah is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a dmah that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93267
EUVD
EUVD-2026-86139

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RDMA subsystem. It occurs when accessing a DMA handle via netlink, where synchronization relies on rdma_restrack_get(). The issue arises because rdma_restrack_del() is called too late in uverbs_free_dmah(), after vendor-specific resources may already be freed. This creates a window where the DMA handle remains accessible through restrack but its internal resources are gone, leading to potential use-after-free scenarios.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA subsystem and requires kernel-level inspection. Detection involves checking for kernel logs or traces related to use-after-free conditions in RDMA operations. Commands like dmesg, journalctl -k, or kernel tracing tools (e.g., ftrace) may help identify abnormal behavior. However, no direct commands are provided in the context to detect this specific issue.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a use-after-free condition, potentially causing system crashes, data corruption, or privilege escalation. Systems using RDMA (Remote Direct Memory Access) features are particularly at risk if they rely on the affected kernel components.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it is a low-level kernel memory management issue in the Linux RDMA subsystem. Compliance risks would only arise if exploitation led to unauthorized data access or system compromise, which is not indicated in the provided context.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update your kernel to a version that includes the fix for CVE-2026-93267. Monitor vendor advisories for RDMA-related updates and ensure all RDMA services are restarted after the kernel update to apply the changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart