CVE-2026-92513: Linux kernel · RDMA/mana_ib: drain QP references after partial table insertion
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in 638b9a5364c1482e5d104823c1a3884b3d249484 : patch Linux kernel soon.
Data as of 26 Oct 2026, 15:19 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 638b9a5364c1482e5d104823c1a3884b3d249484, 97f7c2262c28ebcae64fc957ee978646684a5ed9, 4aaa2ab816c710be7385b31d08373edcdcd71656
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to 638b9a5364c1482e5d104823c1a3884b3d249484, 97f7c2262c28ebcae64fc957ee978646684a5ed9 or 4aaa2ab816c710be7385b31d08373edcdcd71656.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the Linux kernel. Users should update to the fixed versions identified by commits 638b9a5364c1482e5d104823c1a3884b3d249484, 97f7c2262c28ebcae64fc957ee978646684a5ed9, and 4aaa2ab816c710be7385b31d08373edcdcd71656. No additional mitigation is required once the patch is applied.
Description
A use-after-free vulnerability exists in the Linux kernel's RDMA mana_ib component due to improper handling of queue pair (QP) references during partial table insertion. The flaw occurs when a QP is published at its send-queue ID before the receive-queue ID insertion completes, allowing a concurrent completion handler to take a transient reference. If the second insertion fails, the rollback only removes the send-queue entry, leaving references outstanding while the RDMA core frees the QP, causing a use-after-free condition. This issue has been fixed by properly draining references and waiting for QP free completion.