CVE-2026-92513

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mana_ib: drain QP references after partial table insertion

mana_table_store_ud_qp() publishes a QP at its send-queue id before

inserting the receive-queue id, dropping the XArray lock between the two

xa_insert_irq() calls. A concurrent completion handler can look up the QP

and take a transient reference. When the second insertion fails, the

rollback erased only the send-queue entry and returned, leaving both the

initial table reference and the transient reference outstanding while RDMA

core frees the QP, causing a use-after-free.

Drain the reference as normal destruction does: drop the initial reference

and wait for qp->free, releasing the QP only after every concurrent lookup

returns its reference.