CVE-2026-90308

Summary

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Hold QP references for AE and CM processing

AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa and then use or reference them outside the xarray lock. erdma_destroy_qp() can drop the destroy-path reference and free QP resources while such a lookup is in flight.

Add erdma_qp_get_by_qpn() to acquire a kref under the xarray lock with kref_get_unless_zero(). Remove the QP from the xarray before dropping the destroy-path reference so no new lookup can acquire it while destruction waits for existing users.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < 6e32f84b63c054e09392153125d7202abab2d14baffected
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < ec987c0654651036dad6a42f7fa2a6d7c16a3687affected
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < c92686867638cda954fdb2bdbac8a75e3aa6eaaeaffected
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < a52eeff32024f190b3bdc99088c7becccd4fa60baffected
LinuxLinux6.0affected
LinuxLinux0 < 6.0unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References