CVE-2026-90308 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Hold QP references for AE and CM processing
AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa and then use or reference them outside the xarray lock. erdma_destroy_qp() can drop the destroy-path reference and free QP resources while such a lookup is in flight.
Add erdma_qp_get_by_qpn() to acquire a kref under the xarray lock with kref_get_unless_zero(). Remove the QP from the xarray before dropping the destroy-path reference so no new lookup can acquire it while destruction waits for existing users.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's RDMA/erdma driver contains a concurrency vulnerability related to improper handling of Queue Pair references during Asynchronous Event and Connection Manager processing. This issue stems from a race condition where QPs are loaded from the device-specific xarray without maintaining adequate reference counts, leading to potential use-after-free scenarios when concurrent destruction operations occur. The core technical flaw lies in the sequence of operations performed during AE fatal event handling and iWARP CM path establishment. These processes retrieve Queue Pair pointers from dev->qp_xa but subsequently access or reference these objects outside the protection of the xarray lock, creating a window where the underlying memory can be freed by another thread while still being actively used.
The specific mechanism triggering this vulnerability involves erdma_destroy_qp(), which is responsible for tearing down QP resources. This function drops the destroy-path reference and proceeds to free QP memory even when other threads may still hold active references obtained through lookups that are currently in flight but have not yet completed their critical sections. Because the lookup operation does not atomically acquire a persistent reference count under the lock, there is no guarantee that the object remains valid after the xarray lock is released and before the user code finishes processing it. This classic race condition allows for memory corruption or kernel panic if the freed memory is accessed during this narrow timing window.
From an industry standards perspective, this vulnerability maps directly to CWE-416: Use After Free, as the system attempts to access memory that has already been deallocated due to insufficient reference counting and locking discipline. In terms of attack vector classification within MITRE ATT&CK, this aligns with Taint Analysis techniques where malicious actors could potentially exploit the race condition through carefully timed concurrent operations to trigger undefined behavior or gain unauthorized code execution privileges by manipulating kernel memory state. The lack of atomicity in acquiring references while holding locks represents a fundamental violation of safe concurrency practices required for robust kernel subsystems.
The operational impact of this vulnerability is severe, as it can lead to system instability, data corruption, or privilege escalation depending on the context in which the race condition is triggered. An attacker with local access could potentially craft concurrent RDMA operations that force the kernel into an inconsistent state by rapidly creating and destroying Queue Pairs while simultaneously triggering asynchronous events or connection manager activities. This creates opportunities for denial of service through system crashes or, more critically, exploitation paths leading to arbitrary code execution within kernel space. The severity is compounded by the fact that RDMA interfaces are often exposed in high-performance computing environments where such concurrent operations might occur naturally under heavy load, increasing the likelihood of accidental triggering without explicit malicious intent.
To mitigate this vulnerability, developers implemented a fix centered around introducing erdma_qp_get_by_qpn(), a new function designed to safely acquire kernel reference counts for Queue Pairs. This function utilizes kref_get_unless_zero() while holding the xarray lock, ensuring that references are only acquired if the object is still valid and not in the process of being destroyed. Furthermore, the fix modifies the destruction sequence by removing QPs from the xarray before dropping the destroy-path reference. This ensures that no new lookups can successfully acquire a reference to a QP while its destruction is pending completion. By enforcing this strict ordering, the kernel guarantees that all existing users will complete their operations before resources are freed, effectively eliminating the race condition window and restoring memory safety for RDMA/erdma operations.