Executive brief
The Linux kernel's erdma RDMA (Remote Direct Memory Access) driver has a race condition that can cause a server or system using this driver to crash or potentially execute arbitrary code. Event queue handlers can access Completion Queue (CQ) data structures that have been freed by a concurrent destroy operation, leading to memory corruption when processing network I/O completion events.
Technical details
This is a use-after-free vulnerability in the erdma RDMA driver's event queue (EQ) handler. The vulnerable code path involves EQ handlers looking up and invoking CQ callbacks without holding a reference, while erdma_destroy_cq() can concurrently erase the CQ from the xarray and free associated queue buffers and doorbell records. The fix adds a refcount mechanism to CQs: EQ handlers now acquire a reference under xarray lock using refcount_inc_not_zero(), and the destroy path removes the CQ from xarray before dropping references and waiting for in-flight EQ users. Attack vector requires local or network capability to trigger CQ destruction while EQ events are pending; no authentication is needed for a local attacker with ability to control device operations.
Affected products
- Linux Linux kernel affected versions in drivers/infiniband/hw/erdma/ (detailed version range not specified in advisory)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-07-30: patched: Fix committed by Cheng Xu
- 2026-09-14: patched: Patch included in stable kernel releases