CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Hold QP references for AE and CM processing
AE QP fatal events and iWARP CM paths load QPs from dev->qpxa and then use or reference them outside the xarray lock. erdmadestroyqp() can drop the destroy-path reference and free QP resources while such a lookup is in flight.
Add erdmaqpgetbyqpn() to acquire a kref under the xarray lock with krefgetunlesszero(). Remove the QP from the xarray before dropping the destroy-path reference so no new lookup can acquire it while destruction waits for existing users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's RDMA erdma driver are exposed when AE QP fatal-event handling or iWARP connection-management processing can look up and use a queue pair while that queue pair is being destroyed.
What condition is required to trigger the vulnerability?
A race is required between AE or iWARP CM processing that looks up a QP through dev->qp_xa and erdma_destroy_qp() freeing that QP's resources. The issue occurs because the lookup previously used or referenced the QP after releasing the xarray lock without holding a QP reference.
How can I determine whether the fix is present?
Check whether the kernel includes the change that adds erdma_qp_get_by_qpn() with kref_get_unless_zero() under the xarray lock, and removes the QP from the xarray before the destroy-path reference is dropped. The provided stable commits are 6e32f84b63c054e09392153125d7202abab2d14b, ec987c0654651036dad6a42f7fa2a6d7c16a3687, and c92686867638cda954fdb2bdbac8a75e3aa6eaae.