CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Fix CEQ tasklet use-after-free on removal
Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls erdmaceqcompletionhandler(), which reads the DMA-coherent EQ ring through getnextvalideqe() and updates eq->dbrec through notifyeq().
erdmaceqsuninit() frees each CEQ IRQ and then destroys its EQ. freeirq() prevents another hard IRQ and waits for an in-flight handler, but it does not drain a tasklet that the handler already scheduled. The tasklet can therefore access eq->qbuf or eq->dbrec after erdmaeqdestroy() frees them.
Clearing ceqcb->ready does not synchronize with a tasklet that already passed the check at the start of erdmaceqcompletionhandler().
Kill the tasklet after freeirq(), when no handler can schedule it again, and before erdmacequninitone() releases the EQ buffers.
Event History
Frequently Asked Questions
When can this use-after-free occur?
It can occur during removal or teardown of an RDMA/erdma device when a CEQ interrupt handler has already scheduled its tasklet. After free_irq() stops and waits for hard IRQ handlers, the previously scheduled tasklet may still run while the EQ buffers are being destroyed.
Why is freeing the IRQ alone insufficient?
free_irq() prevents new hard IRQ handling and waits for an active handler, but it does not drain tasklets that an earlier handler scheduled. The pending tasklet can still read the freed EQ ring buffer or update the freed doorbell record.
What is the required teardown ordering to prevent the issue?
The CEQ tasklet must be killed after free_irq(), when no further interrupt handler can schedule it, and before erdma_ceq_uninit_one() releases the EQ resources. Clearing the ready flag alone is not sufficient because a tasklet may already have passed its readiness check.