Executive brief
A use-after-free vulnerability exists in the Linux kernel's RDMA (Remote Direct Memory Access) counter tracking subsystem. When a counter resource is released, it remains accessible through the kernel's resource tracking system even after its internal data structures have been freed, creating a window where a privileged user or local attacker could potentially access freed memory. This could lead to information disclosure or kernel crashes.
Technical details
The vulnerability is a use-after-free in the counter_release() function of the RDMA core subsystem (drivers/infiniband/core/counters.c). The root cause is improper ordering of cleanup operations: rdma_restrack_del() was being called after vendor-specific resources were already freed, leaving a race window where the counter remains accessible via the netlink resource tracking path (rdma_restrack_get/put) despite being partially destroyed. The fix reorders operations to call rdma_restrack_del() before freeing vendor resources, and changes kref_get() to kref_get_unless_zero() to prevent acquiring references to dying objects. The vulnerability requires local access and knowledge of RDMA counter management, but no special authentication is needed once access to the netlink interface is available.
Affected products
- Linux Linux kernel Affected versions span multiple stable series; patch commits 235ef2d0e750885c29340b0fc40620a7a4f52e12 and backports indicate impact across linux-4.x through linux-6.x and later
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-07-13: patched: Upstream fix committed (235ef2d0e750885c29340b0fc40620a7a4f52e12)
- 2026-09-14: patched: Backport to stable kernels (2f0c6705e26ba92c0c6b0b0908a2d3f35a039d5b)