CVE-2026-92514 - Vulnerability Details

- RDMA/erdma: Fix CEQ tasklet use-after-free on removal

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Fix CEQ tasklet use-after-free on removal

Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls
erdma_ceq_completion_handler(), which reads the DMA-coherent EQ ring
through get_next_valid_eqe() and updates eq->dbrec through notify_eq().

erdma_ceqs_uninit() frees each CEQ IRQ and then destroys its EQ.
free_irq() prevents another hard IRQ and waits for an in-flight handler,
but it does not drain a tasklet that the handler already scheduled. The
tasklet can therefore access eq->qbuf or eq->dbrec after
erdma_eq_destroy() frees them.

Clearing ceq_cb->ready does not synchronize with a tasklet that already
passed the check at the start of erdma_ceq_completion_handler().

Kill the tasklet after free_irq(), when no handler can schedule it again,
and before erdma_ceq_uninit_one() releases the EQ buffers.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs when the erdma CEQ interrupt handler schedules a tasklet that later accesses DMA‑coherent memory that has been freed during CEQ removal. This use‑after‑free leads to a memory corruption in the kernel, potentially triggering a panic or crash. The weakness is a classic memory‑corruption flaw, consistently classified as CWE‑416.

Affected Systems

The flaw attacks the Linux kernel RDMA/erdma driver. Any system that loads the erdma module and runs a kernel version before the referenced commit fixes is susceptible. No specific release dates are provided, so all current kernels that have not yet incorporated the patch are at risk.

Risk and Exploitability

The EPSS score indicates a very low exploitation probability (<1 %), and the vulnerability is not listed in the CISA KEV catalog. A CVSS score has not been disclosed. Exploitation requires initiating a CEQ removal, which typically demands privileged kernel access; this requirement is inferred from the nature of the operation but is not explicitly stated in the advisory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f2a0a630b953451a59a2612ad8c29246638f0a38`	affected	< 0e8b78dabb1f156db05ffe74c6eae861167c7c21
`f2a0a630b953451a59a2612ad8c29246638f0a38`	affected	< 6e129c1310abfa786a510cc63e69c5ef12349048
`f2a0a630b953451a59a2612ad8c29246638f0a38`	affected	< f738c0a372d36a10dfae6dc357717c13b2aa72f4
`f2a0a630b953451a59a2612ad8c29246638f0a38`	affected	< a60c36d8d17f1b86705523d5eb6d290df28831e5
`f2a0a630b953451a59a2612ad8c29246638f0a38`	affected	< 61a25b8d333e1eb2a189881d516f8d5194e26840
`f2a0a630b953451a59a2612ad8c29246638f0a38`	affected	< 0ca79979384f031d710c4b3bae065dcb5d95aca3

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f2a0a630b953451a59a2612ad8c29246638f0a38,0e8b78dabb1f156db05ffe74c6eae861167c7c21)`	affected	code_commit	—
`[f2a0a630b953451a59a2612ad8c29246638f0a38,6e129c1310abfa786a510cc63e69c5ef12349048)`	affected	code_commit	—
`[f2a0a630b953451a59a2612ad8c29246638f0a38,f738c0a372d36a10dfae6dc357717c13b2aa72f4)`	affected	code_commit	—
`[f2a0a630b953451a59a2612ad8c29246638f0a38,a60c36d8d17f1b86705523d5eb6d290df28831e5)`	affected	code_commit	—
`[f2a0a630b953451a59a2612ad8c29246638f0a38,61a25b8d333e1eb2a189881d516f8d5194e26840)`	affected	code_commit	—
`[f2a0a630b953451a59a2612ad8c29246638f0a38,0ca79979384f031d710c4b3bae065dcb5d95aca3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	generic	—
`[0,6.0)`	unaffected	generic	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a release that incorporates the erdma CEQ tasklet fix, such as the commit series referenced in the advisory.
If a kernel upgrade cannot be performed immediately, prevent removal of CEQs or unloading of the erdma module until the patch is applied; ensure no pending tasklets are scheduled.
Apply the individual commit patches (e.g., 0ca7997, 0e8b78d, 61a25b8, 6e129c1, a60c36d, f738c0a) to the working kernel or a custom build until an official distribution package becomes available.

Generated by OpenCVE AI on September 19, 2026 at 13:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00205.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ca79979384f031d710c4b3bae065dcb5d95aca3
https://git.kernel.org/stable/c/0e8b78dabb1f156db05ffe74c6eae861167c7c21
https://git.kernel.org/stable/c/61a25b8d333e1eb2a189881d516f8d5194e26840
https://git.kernel.org/stable/c/6e129c1310abfa786a510cc63e69c5ef12349048
https://git.kernel.org/stable/c/a60c36d8d17f1b86705523d5eb6d290df28831e5
https://git.kernel.org/stable/c/f738c0a372d36a10dfae6dc357717c13b2aa72f4

History

Sat, 19 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls erdma_ceq_completion_handler(), which reads the DMA-coherent EQ ring through get_next_valid_eqe() and updates eq->dbrec through notify_eq(). erdma_ceqs_uninit() frees each CEQ IRQ and then destroys its EQ. free_irq() prevents another hard IRQ and waits for an in-flight handler, but it does not drain a tasklet that the handler already scheduled. The tasklet can therefore access eq->qbuf or eq->dbrec after erdma_eq_destroy() frees them. Clearing ceq_cb->ready does not synchronize with a tasklet that already passed the check at the start of erdma_ceq_completion_handler(). Kill the tasklet after free_irq(), when no handler can schedule it again, and before erdma_ceq_uninit_one() releases the EQ buffers.
Title		RDMA/erdma: Fix CEQ tasklet use-after-free on removal
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ca79979384f031d710c4b3bae065dcb5d95aca3 https://git.kernel.org/stable/c/0e8b78dabb1f156db05ffe74c6eae861167c7c21 https://git.kernel.org/stable/c/61a25b8d333e1eb2a189881d516f8d5194e26840 https://git.kernel.org/stable/c/6e129c1310abfa786a510cc63e69c5ef12349048 https://git.kernel.org/stable/c/a60c36d8d17f1b86705523d5eb6d290df28831e5 https://git.kernel.org/stable/c/f738c0a372d36a10dfae6dc357717c13b2aa72f4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:10:23.462Z

Updated: 2026-09-17T16:10:23.462Z

Reserved: 2026-09-16T12:21:13.873Z

Link: CVE-2026-92514

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:54.243

Modified: 2026-09-17T17:17:54.243

Link: CVE-2026-92514

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-19T13:15:16Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object