CVE-2026-93267

A race condition was found in the Linux kernel RDMA subsystem where a Direct Memory Access Handle (DMAH) undergoing deallocation in uverbs_free_dmah() could have its vendor-specific resources freed before it was removed from RDMA resource tracking (restrack), leaving a short window in which the handle could still be reached through the netlink resource-tracking path. A local attacker with access to RDMA devices who is able to create and destroy DMAH objects while issuing concurrent netlink queries could exploit this race to reference already-freed memory, causing a use-after-free that could crash the kernel (denial of service) or potentially lead to privilege escalation. Red Hat has rated this flaw as Moderate for the affected products. The DMAH object APIs that contain this flaw were introduced in recent RHEL 9 (9.8 and later) and RHEL 10 (10.2 and later) kernels, and the flaw is also present in Red Hat In-Vehicle OS 2 and in OpenShift Container Platform releases shipped with affected RHEL 9-based CoreOS kernels. Earlier RHEL 6, 7, and 8 releases and older RHEL 9 and RHEL 10 update streams do not contain the vulnerable code and are therefore not affected. Red Hat has deferred the fix for the affected streams to a future planned update; because exploitation requires local access to RDMA-capable hardware, the ability to create DMAH objects, and winning a narrow race window, the residual risk while the fix is deferred is primarily local denial of service.