HIGH Introduced in 6.17
infiniband Dmah UAF
CVE-2026-93267
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in uverbs_free_dmah() When accessing a dmah via the netlink path the only synchronization mechanism for the said dmah is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of uverbs_free_dmah(), which is too late, since by that point vendor-specific resources associated with the dmah might already be freed. This can leave a short window where the dmah remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of uverbs_free_dmah(), ensuring that the dmah is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a dmah that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.
02KernelScan AI Analysis
Risk summary
A local attacker with access to RDMA-capable hardware can exploit a race condition in the DMA handle destruction path to trigger a use-after-free, potentially leading to kernel memory corruption, privilege escalation, or a system crash. Systems with RDMA hardware present and device files accessible to non-root users are at risk.
Vulnerability analysis
During destruction of an RDMA DMA handle object, the kernel removes the object from its resource-tracking database only after vendor-specific resources have already been deallocated, leaving a window in which a concurrent query arriving through the RDMA netlink interface can still find and dereference the object's freed memory. The fix reorders the teardown so the object is first marked as being deleted from the resource tracker — blocking new lookups from reaching it — before any internal resources are released, with a rollback path if the deallocation fails. A local process with access to RDMA device files can trigger this race by destroying a DMA handle while another thread queries the resource tracker via netlink, requiring RDMA-capable hardware to be present and accessible on the system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.17 | 6.18.52 | 8b22722f45a2 |
| 7.2 | 6.17 | 7.2.6 | bfc119a40c04 |
| mainline | 6.17 | 7.3 | 2696626a0be5 |