In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in uverbs_free_dmah() When accessing a dmah via the netlink path the only synchronization mechanism for the said dmah is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of uverbs_free_dmah(), which is too late, since by that point vendor-specific resources associated with the dmah might already be freed. This can leave a short window where the dmah remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of uverbs_free_dmah(), ensuring that the dmah is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a dmah that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after
    free in uverbs_free_dmah() When accessing a dmah via the netlink path the only synchronization mechanism
    for the said dmah is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of
    uverbs_free_dmah(), which is too late, since by that point vendor-specific resources associated with the
    dmah might already be freed. This can leave a short window where the dmah remains accessible through
    restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to
    the start of uverbs_free_dmah(), ensuring that the dmah is removed from restrack before its internal
    resources are released. This guarantees that no new users hold references to a dmah that is in the process
    of destruction. In addition, this change preserves the intended inverted order between create and destroy
    routines: resources are added to restrack at the end of successful creation, and hence shall be removed
    from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent
    and predictable. (CVE-2026-93267)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RDMA/core: Fix potential use after free in uverbs_free_dmah() When accessing a dmah via the netlink path     the only synchronization mechanism for the said dmah is rdma_restrack_get(). Currently,     rdma_restrack_del() is invoked at the end of uverbs_free_dmah(), which is too late, since by that point     vendor-specific resources associated with the dmah might already be freed. This can leave a short window     where the dmah remains accessible through restrack, leading to a potential use-after-free. Fix this by     moving the rdma_restrack_begin_del() call to the start of uverbs_free_dmah(), ensuring that the dmah is     removed from restrack before its internal resources are released. This guarantees that no new users hold     references to a dmah that is in the process of destruction. In addition, this change preserves the     intended inverted order between create and destroy routines: resources are added to restrack at the end of     successful creation, and hence shall be removed from the restrack first thing during the destruction flow,     which keeps the lifecycle management consistent and predictable. (CVE-2026-93267)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
475696	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0	Tenable Cloud Security	Google COS Security Checks	Local	high
475696	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
475101	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Cloud Security	Google COS Security Checks	Local	high
475101	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
350232	Linux Distros Unpatched Vulnerability : CVE-2026-93267	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-93267

high

Tenable Plugins

high

high

high

high

high