CVE-2026-98429: RDMA/efa: Keep EQ resources alive while IRQ is registered
In the Linux kernel, the following vulnerability has been resolved:
RDMA/efa: Keep EQ resources alive while IRQ is registered
The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before freeirq() synchronized the handler.
Initialize the EQ without arming it, register the IRQ, and then arm it. Reverse the resource order during teardown by freeing the IRQ before destroying the EQ.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the RDMA/efa driver are the relevant population. The issue concerns the driver's completion event queue and its IRQ handling.
What condition triggers the vulnerability?
The race occurs when the completion IRQ handler runs while the EQ state or DMA buffer is not yet initialized, or after teardown has released the buffer before the IRQ is freed and synchronized.
What does the fix change?
The fix initializes the EQ without arming it, registers the IRQ, and only then arms the EQ. During teardown, it frees the IRQ before destroying the EQ resources, preventing the handler from accessing released state.