{"id":"CVE-2026-92488","summary":"RDMA/erdma: complete object teardown when the destroy command fails","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/erdma: complete object teardown when the destroy command fails\n\nerdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and\nerdma_destroy_ah() returned early when erdma_post_cmd_wait() failed,\nleaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN\nidentifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and\npermanently disables the command queue, so no retry can succeed; the RDMA\ncore keeps the object after a failed destructor and forced uverbs cleanup\nthen nulls the pointers, making the resources unreachable.\n\nWarn on failure but release every software-owned resource and return\nsuccess, since during terminal destruction the hardware command result is\nonly diagnostic.","modified":"2026-09-19T03:47:29.501060601Z","published":"2026-09-17T16:10:02.962Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92488.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/334145d683ad3e31d052247f10807f2ebc950351"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabe"},{"type":"WEB","url":"https://git.kernel.org/stable/c/652befcba956ef357f480525ccbe25c59bc81d4d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ce7d205c264665517c25e8a3231cf2d0c2443e3c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92488.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92488"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"155055771704f8cbb5c176a4309b7dc30a50450c"},{"fixed":"5fcfc988ecf3e2bbe308b95c2c0d2f011d9afabe"},{"fixed":"ce7d205c264665517c25e8a3231cf2d0c2443e3c"},{"fixed":"334145d683ad3e31d052247f10807f2ebc950351"},{"fixed":"652befcba956ef357f480525ccbe25c59bc81d4d"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92488.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92488.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}