Linux Kernel EUVD-2026-93180

Requires the RDMA/iWARP port mapper (iwpm) subsystem to be active - i.e., InfiniBand/RDMA hardware or software RDMA (rxe/siw) loaded and the iWARP port-mapper netlink interface in use - which is NOT the default on general-purpose desktop/server installs. The attacker needs local code execution with low privileges (PR:L) and must drive concurrent nlmsg_request operations to win the narrow race window between list_add_tail() exposing the object on the global list and the subsequent kref initialization (AC:H). Limiting factors: local-only (AV:L, no remote reach), no user interaction, dependence on a non-default RDMA stack, and the need to reliably win a timing race on an SMP system, all of which substantially constrain real-world exploitability.

This is a real but comparatively low-priority defensive issue despite its 7.0 (High) CVSS score. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent for a kernel race condition: AV:L means no remote reach, AC:H reflects the narrow timing window between list_add_tail() and kref initialization that an attacker must win, and PR:L means local low-privileged code must already be running. The full C:H/I:H/A:H impact is justified because a refcount 'addition on 0' bug leads to use-after-free and kernel memory corruption, which can escalate to full compromise. The exploitation signals argue AGAINST urgency, however: EPSS is only 0.22% (11th percentile), this is NOT on the CISA KEV list, and there is no public exploit identified at time of analysis. The 'Information Disclosure' tag conflicts with the I:H/A:H integrity and availability impacts in the CVSS vector - this is a memory-corruption/use-after-free class flaw, not a pure disclosure bug, so treat the tag as under-scoped. Net: a legitimate memory-safety fix worth patching in the normal cycle, but it requires pre-existing local access, a winnable race, and an active RDMA/iWARP stack, so it is not a drop-everything emergency.

A local, low-privileged attacker on a Linux host with the RDMA/iWARP port mapper active issues many concurrent iwpm netlink requests to repeatedly hit the window where a nlmsg_request is added to the global list before its refcount is initialized. By winning this race on another CPU, the attacker triggers a 'kref_get on 0' use-after-free, corrupting kernel memory to pursue privilege escalation. No public exploit code is identified, and the high attack complexity (AC:H) and local-only vector make reliable exploitation difficult.