CVE-2026-93267

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/core: Fix potential use after free in uverbs_free_dmah()<br /> <br /> When accessing a dmah via the netlink path the only synchronization<br /> mechanism for the said dmah is rdma_restrack_get().<br /> Currently, rdma_restrack_del() is invoked at the end of<br /> uverbs_free_dmah(), which is too late, since by that point<br /> vendor-specific resources associated with the dmah might already be<br /> freed. This can leave a short window where the dmah remains accessible<br /> through restrack, leading to a potential use-after-free.<br /> <br /> Fix this by moving the rdma_restrack_begin_del() call to the start of<br /> uverbs_free_dmah(), ensuring that the dmah is removed from restrack<br /> before its internal resources are released. This guarantees that no new<br /> users hold references to a dmah that is in the process of destruction.<br /> <br /> In addition, this change preserves the intended inverted order<br /> between create and destroy routines: resources are added to<br /> restrack at the end of successful creation, and hence shall be removed<br /> from the restrack first thing during the destruction flow, which keeps<br /> the lifecycle management consistent and predictable.