CVE-2026-90308
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
41/100
Published: 2026-09-17
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa and then use or reference them outside the xarray lock. erdma_destroy_qp() can drop the destroy-path reference and free QP resources while such a lookup is in flight. Add erdma_qp_get_by_qpn() to acquire a kref under the xarray lock with kref_get_unless_zero(). Remove the QP from the xarray before dropping the destroy-path reference so no new lookup can acquire it while destruction waits for existing users.
Affected Software (7)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | 155055771704f8cbb5c176a4309b7dc30a50450c < 92101d7bd67cf313d65baede27118614a283f6bf |
| Linux | Linux | 155055771704f8cbb5c176a4309b7dc30a50450c < 233f1b7fe2980e4e238fe03dd3ceddfd082cb4c8 |
| Linux | Linux | 155055771704f8cbb5c176a4309b7dc30a50450c < 6e32f84b63c054e09392153125d7202abab2d14b |
| Linux | Linux | 155055771704f8cbb5c176a4309b7dc30a50450c < ec987c0654651036dad6a42f7fa2a6d7c16a3687 |
| Linux | Linux | 155055771704f8cbb5c176a4309b7dc30a50450c < c92686867638cda954fdb2bdbac8a75e3aa6eaae |
| Linux | Linux | 155055771704f8cbb5c176a4309b7dc30a50450c < a52eeff32024f190b3bdc99088c7becccd4fa60b |
| Linux | Linux | 6.0 |