CVE-2026-90309

Summary

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Hold CQ references when processing EQ events

EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or error callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ from the xarray and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using the CQ.

Add a CQ refcount and take a reference under the xarray lock with refcount_inc_not_zero(). Remove the CQ from the xarray before dropping the destroy-path reference, then wait for in-flight EQ users before releasing CQ resources.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < 610ef81797bb4f709e8675c1d8d093bb9ccdcbd8affected
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < c0a83f29a24c7e7f8516630848ef6db4c174deedaffected
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < 05b8ca493dd02319bca93c640b259c2ba51ef321affected
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < 1fc9c1933959d2776a1ce7bf424251b8b5b586cdaffected
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < 4545f355654d044d35a31cd01cc46f491a8a7c36affected
LinuxLinux155055771704f8cbb5c176a4309b7dc30a50450c < 98df2aee1459ee1c62c70cbe9b370d2a532aea36affected
LinuxLinux6.0affected
LinuxLinux0 < 6.0unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References