CVE-2026-93277

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Validate udata before executing commands

The destroy callbacks currently zero the udata output after tearing down

driver resources. If the userspace access fails, uverbs preserves the

uobject and allows the destroy callback to run again, even though the

driver resource has already been freed.

Call ib_no_udata_io() before teardown so udata failures are detected

while the resource is still intact, then return success after teardown

completes.

As part of this change, move ib_respond_empty_udata() to the start of

the create and modify flows. While this is not strictly required for

general create flows, as the core layer unwinds uobjects on failure, it

is necessary for create AH. In _rdma_create_ah(), the HW object is

otherwise leaked.