In the Linux kernel, the following vulnerability has been resolved:
RDMA/mana_ib: drain QP references after partial table insertion
mana_table_store_ud_qp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xa_insert_irq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free.
Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Oct 22, 2026 | Sep 17, 2026 |
| Ubuntu | — | Upgrade linux-riscvUpgrade linux-oem-7.0Upgrade linux-riscv-7.0Upgrade linuxUpgrade linux-hwe-7.0Upgrade linux-awsUpgrade linux-ibmUpgrade linux-gcpUpgrade linux-oracle | Nov 3, 2026 | Sep 17, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub