CVE-2026-98430: RDMA/efa: Keep admin queues alive while IRQ is registered
In the Linux kernel, the following vulnerability has been resolved:
RDMA/efa: Keep admin queues alive while IRQ is registered
The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed them before freeing the IRQ, so the handler's lifetime was not contained by the resources it accesses.
Initialize the queues with interrupts masked, request the IRQ, and then switch to interrupt mode. On removal, reset the device and free the IRQ before destroying the queues. Also reset the device before destroying the queues if IRQ registration fails, because the device already has their DMA addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the EFA driver resource lifecycle so admin and asynchronous event queues are initialized with interrupts masked, the IRQ is requested before switching to interrupt mode, and the queues remain alive until the IRQ is freed; on device removal, reset the device before destroying the queues and freeing the IRQ.
Event History
Frequently Asked Questions
When can this issue be triggered?
The unsafe lifetime window exists during EFA driver initialization and removal. It can also occur after IRQ registration fails, because the device may already hold DMA addresses for the admin queues.
What resources are involved in the race?
The management IRQ handler accesses the admin completion queue and async event queue. Previously, the IRQ could be registered before those queues were constructed or remain registered after they were destroyed.
What is the relevant remediation behavior?
The corrected sequence initializes queues with interrupts masked, registers the IRQ, and only then enables interrupt mode. During removal, the device is reset and the IRQ is freed before the queues are destroyed.
What should be done if IRQ registration fails during initialization?
Reset the device before destroying the queues. This is necessary because the device may already have DMA addresses pointing to those queue resources.