CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Hold CQ references when processing EQ events
EQ handlers look up CQs from dev->cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq() can erase the CQ from the xarray and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using the CQ.
Add a CQ refcount and take a reference under the xarray lock with refcountincnotzero(). Remove the CQ from the xarray before dropping the destroy-path reference, then wait for in-flight EQ users before releasing CQ resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In RDMA/erdma CQ lifecycle and EQ handling, add a CQ refcount; under the xarray lock, take a reference with refcount_inc_not_zero(); remove the CQ from dev->cq_xa before dropping the destroy-path reference; then wait for in-flight EQ users before releasing CQ resources such as the queue buffer and doorbell record.
Event History
Frequently Asked Questions
What systems are exposed to this race condition?
Systems using the Linux kernel's RDMA erdma driver are exposed when completion queues can be destroyed while event-queue handlers are processing events for those queues.
What condition is required to trigger the issue?
An EQ handler must obtain a CQ and invoke its completion or error callback after releasing the xarray lock, while another execution path destroys that same CQ. The destroy path can then free the CQ queue buffer and doorbell record while the handler still uses the CQ.
How can I tell whether the fix is present?
Check whether the kernel includes the change that adds CQ reference counting, acquires a nonzero CQ reference under the xarray lock for EQ processing, removes the CQ from the xarray before dropping the destroy reference, and waits for in-flight EQ users before releasing CQ resources.