CVE-2026-90309

RDMA/erdma: Hold CQ references when processing EQ events

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Hold CQ references when processing EQ events

EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or error callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ from the xarray and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using the CQ.

Add a CQ refcount and take a reference under the xarray lock with refcount_inc_not_zero(). Remove the CQ from the xarray before dropping the destroy-path reference, then wait for in-flight EQ users before releasing CQ resources.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	155055771704f8cbb5c176a4309b7dc30a50450c to before 610ef81797bb4f709e8675c1d8d093bb9ccdcbd8Affected 155055771704f8cbb5c176a4309b7dc30a50450c to before c0a83f29a24c7e7f8516630848ef6db4c174deedAffected 155055771704f8cbb5c176a4309b7dc30a50450c to before 05b8ca493dd02319bca93c640b259c2ba51ef321Affected 155055771704f8cbb5c176a4309b7dc30a50450c to before 1fc9c1933959d2776a1ce7bf424251b8b5b586cdAffected 155055771704f8cbb5c176a4309b7dc30a50450c to before 4545f355654d044d35a31cd01cc46f491a8a7c36Affected 155055771704f8cbb5c176a4309b7dc30a50450c to before 98df2aee1459ee1c62c70cbe9b370d2a532aea36Affected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

155055771704f8cbb5c176a4309b7dc30a50450c to before 610ef81797bb4f709e8675c1d8d093bb9ccdcbd8Affected
155055771704f8cbb5c176a4309b7dc30a50450c to before c0a83f29a24c7e7f8516630848ef6db4c174deedAffected
155055771704f8cbb5c176a4309b7dc30a50450c to before 05b8ca493dd02319bca93c640b259c2ba51ef321Affected
155055771704f8cbb5c176a4309b7dc30a50450c to before 1fc9c1933959d2776a1ce7bf424251b8b5b586cdAffected
155055771704f8cbb5c176a4309b7dc30a50450c to before 4545f355654d044d35a31cd01cc46f491a8a7c36Affected
155055771704f8cbb5c176a4309b7dc30a50450c to before 98df2aee1459ee1c62c70cbe9b370d2a532aea36Affected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.