HIGH Introduced in 6.15
mana_ib QPTable UAF
CVE-2026-92513
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: drain QP references after partial table insertion mana_table_store_ud_qp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xa_insert_irq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free. Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.
02KernelScan AI Analysis
Risk summary
A local process with access to a MANA RDMA device (common in Azure VMs) can trigger a use-after-free by racing QP table insertion with completion handling, potentially leading to kernel code execution or a system crash. Exploitation requires winning a narrow race window and is only reachable on systems with the mana_ib RDMA driver loaded.
Vulnerability analysis
When creating an unreliable datagram Queue Pair, the MANA RDMA driver publishes the QP in a lookup table in two steps without holding a lock across both. A concurrent completion handler running on another CPU can find the QP during this window and grab a reference to it. If the second insertion step fails, the error rollback removes only the first table entry and returns without waiting for that transient reference to be released, so the RDMA core frees the QP while another thread is still accessing it. The fix makes the error path drain outstanding references the same way normal QP destruction does—dropping the initial reference and waiting for all concurrent lookups to finish—before returning the failure. The bug is reachable from a local process that can access a MANA RDMA device, as found in certain Azure virtual machines, and requires winning a race between QP creation and completion handling.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.15 | 6.18.52 | 4aaa2ab816c7 |
| 7.2 | 6.15 | 7.2.6 | 638b9a5364c1 |
| mainline | 6.15 | 7.3 | 97f7c2262c28 |