CVE-2026-90308

RDMA/erdma: Hold QP references for AE and CM processing

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Hold QP references for AE and CM processing

AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa and then use or reference them outside the xarray lock. erdma_destroy_qp() can drop the destroy-path reference and free QP resources while such a lookup is in flight.

Add erdma_qp_get_by_qpn() to acquire a kref under the xarray lock with kref_get_unless_zero(). Remove the QP from the xarray before dropping the destroy-path reference so no new lookup can acquire it while destruction waits for existing users.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	155055771704f8cbb5c176a4309b7dc30a50450c to before 92101d7bd67cf313d65baede27118614a283f6bfAffected 155055771704f8cbb5c176a4309b7dc30a50450c to before 233f1b7fe2980e4e238fe03dd3ceddfd082cb4c8Affected 155055771704f8cbb5c176a4309b7dc30a50450c to before 6e32f84b63c054e09392153125d7202abab2d14bAffected 155055771704f8cbb5c176a4309b7dc30a50450c to before ec987c0654651036dad6a42f7fa2a6d7c16a3687Affected 155055771704f8cbb5c176a4309b7dc30a50450c to before c92686867638cda954fdb2bdbac8a75e3aa6eaaeAffected 155055771704f8cbb5c176a4309b7dc30a50450c to before a52eeff32024f190b3bdc99088c7becccd4fa60bAffected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

155055771704f8cbb5c176a4309b7dc30a50450c to before 92101d7bd67cf313d65baede27118614a283f6bfAffected
155055771704f8cbb5c176a4309b7dc30a50450c to before 233f1b7fe2980e4e238fe03dd3ceddfd082cb4c8Affected
155055771704f8cbb5c176a4309b7dc30a50450c to before 6e32f84b63c054e09392153125d7202abab2d14bAffected
155055771704f8cbb5c176a4309b7dc30a50450c to before ec987c0654651036dad6a42f7fa2a6d7c16a3687Affected
155055771704f8cbb5c176a4309b7dc30a50450c to before c92686867638cda954fdb2bdbac8a75e3aa6eaaeAffected
155055771704f8cbb5c176a4309b7dc30a50450c to before a52eeff32024f190b3bdc99088c7becccd4fa60bAffected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.