CVE-2026-92508

CVE-2026-92508 is a use-after-free vulnerability in the Linux kernel's RDMA/core subsystem, specifically in the ib_free_cq() function. The root cause is that rdma_restrack_del() is invoked at the end of the CQ destruction sequence, after vendor-specific resources have already been freed. This cre...

EUVD-2026-82129

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

EUVD-2026-81766

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ibfreecq smbdirectconnectiondestroyqp creates the send and receive completion queues with iballoccqany, which for IBPOLLWORKQUEUE arms an internal completion handler that runs...

CVE-2026-90173

CVE-2026-90173 is a slab-use-after-free in the Linux kernel's smbdirect (RDMA-based SMB Direct) subsystem. The root cause is in smbdirect_connection_destroy_qp(), which frees send/receive completion queues (CQs) via ib_destroy_cq() without first cancelling the workqueue-based poll handler (ib_cq_...