CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Hold QP references for AE and CM processing
AE QP fatal events and iWARP CM paths load QPs from dev->qpxa and then use or reference them outside the xarray lock. erdmadestroyqp() can drop the destroy-path reference and free QP resources while such a lookup is in flight.
Add erdmaqpgetbyqpn() to acquire a kref under the xarray lock with krefgetunlesszero(). Remove the QP from the xarray before dropping the destroy-path reference so no new lookup can acquire it while destruction waits for existing users.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's RDMA erdma driver are exposed when AE QP fatal-event handling or iWARP connection-management processing can look up and use a queue pair while that queue pair is being destroyed.
What condition is required to trigger the vulnerability?
A race is required between AE or iWARP CM processing that looks up a QP through dev->qp_xa and erdma_destroy_qp() freeing that QP's resources. The issue occurs because the lookup previously used or referenced the QP after releasing the xarray lock without holding a QP reference.
How can I determine whether the fix is present?
Check whether the kernel includes the change that adds erdma_qp_get_by_qpn() with kref_get_unless_zero() under the xarray lock, and removes the QP from the xarray before the destroy-path reference is dropped. The provided stable commits are 6e32f84b63c054e09392153125d7202abab2d14b, ec987c0654651036dad6a42f7fa2a6d7c16a3687, and c92686867638cda954fdb2bdbac8a75e3aa6eaae.