Executive brief
The Linux kernel's RDMA erdma driver contains a use-after-free vulnerability in Queue Pair (QP) resource management. Async event handlers and connection management paths can access QP objects after they have been freed during destruction, potentially allowing an attacker with local access to trigger kernel memory corruption, system crashes, or code execution.
Technical details
The vulnerability is a use-after-free caused by a race condition in the erdma RDMA driver's QP lifecycle management. AE (Async Event) and iWARP CM (Connection Manager) paths retrieve QPs from the dev->qp_xa xarray without holding a reference count, then use them outside the xarray lock. Meanwhile, erdma_destroy_qp() can free the QP resources while such a lookup is in flight, leaving pointers to deallocated kernel memory. The fix introduces erdma_qp_get_by_qpn() to acquire a kref (kernel reference) under the xarray lock using kref_get_unless_zero(), and removes the QP from the xarray before dropping the destroy-path reference, preventing new lookups during destruction. Attack vector requires local access to the RDMA subsystem and precise timing to trigger the race.
Affected products
- Linux Linux Kernel Multiple versions (erdma driver component)
Timeline
- 2026-09-17: disclosed: Published as CVE-2026-90308
- 2026-08-05: patched: Upstream fix committed by Leon Romanovsky
- 2026-09-14: patched: Backported to stable kernel trees