The vulnerability in the Linux kernel RDMA core (CVE-2026-92507) is a potential use-after-free in the ib_dealloc_pd_user() function. The synchronization mechanism for a PD accessed via netlink relies on rdma_restrack_get() and rdma_restrack_del(). Previously, rdma_restrack_del() was called too late, after vendor-specific resources were freed, leaving a window where the PD was still accessible through restrack, enabling use-after-free. The patch moves rdma_restrack_begin_del() to the start of ib_dealloc_pd_user(), ensuring the PD is removed from restrack before resource release, maintaining consistent lifecycle management.

This vulnerability allows an attacker with local privileges to exploit a use-after-free condition in the RDMA core, potentially leading to full system compromise affecting confidentiality, integrity, and availability. The CVSS 3.1 score is 7.8 (high severity) with local attack vector, low complexity, requiring privileges but no user interaction.

A fix is available that changes the order of restrack removal in the ib_dealloc_pd_user() function to prevent use-after-free. Users should apply the official Linux kernel patches that address this issue. No additional mitigation is required beyond applying the vendor's fix.