CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Hold CQ references when processing EQ events
EQ handlers look up CQs from dev->cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq() can erase the CQ from the xarray and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using the CQ.
Add a CQ refcount and take a reference under the xarray lock with refcountincnotzero(). Remove the CQ from the xarray before dropping the destroy-path reference, then wait for in-flight EQ users before releasing CQ resources.
Event History
Frequently Asked Questions
What systems are exposed to this race condition?
Systems using the Linux kernel's RDMA erdma driver are exposed when completion queues can be destroyed while event-queue handlers are processing events for those queues.
What condition is required to trigger the issue?
An EQ handler must obtain a CQ and invoke its completion or error callback after releasing the xarray lock, while another execution path destroys that same CQ. The destroy path can then free the CQ queue buffer and doorbell record while the handler still uses the CQ.
How can I tell whether the fix is present?
Check whether the kernel includes the change that adds CQ reference counting, acquires a nonzero CQ reference under the xarray lock for EQ processing, removes the CQ from the xarray before dropping the destroy reference, and waits for in-flight EQ users before releasing CQ resources.