CVE-2026-90309 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Hold CQ references when processing EQ events
EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or error callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ from the xarray and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using the CQ.
Add a CQ refcount and take a reference under the xarray lock with refcount_inc_not_zero(). Remove the CQ from the xarray before dropping the destroy-path reference, then wait for in-flight EQ users before releasing CQ resources.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's RDMA/erdma subsystem contains a race condition vulnerability related to concurrent access and lifecycle management of Completion Queue objects during Event Queue processing. This flaw arises from an improper synchronization mechanism when handling asynchronous events, specifically within the context where EQ handlers interact with CQ structures stored in a global xarray data structure. The core issue lies in the fact that event queue handlers retrieve references to completion queues directly from the device's shared xarray without holding the associated lock during critical operations such as invoking completion or error callbacks. This lack of atomicity creates a window where structural integrity cannot be guaranteed, leading to potential use-after-free scenarios and memory corruption issues within the kernel space.
From a technical perspective, the vulnerability manifests when an event queue handler looks up a CQ object from dev->cq_xa and proceeds to invoke associated completion or error callbacks outside the protection of the xarray lock. Simultaneously, another thread executing erdma_destroy_cq() may erase that same CQ entry from the xarray and subsequently free its underlying resources, including the queue buffer and doorbell record. Because the first thread is still actively using these structures to process events, it ends up accessing memory that has already been deallocated by the destruction path. This classic race condition results in undefined behavior, which can lead to kernel panics, data corruption, or potentially allow an attacker with local access to escalate privileges by exploiting the corrupted state of kernel memory.
The operational impact of this vulnerability is significant for systems relying on high-performance RDMA capabilities provided by erdma hardware. An attacker who can trigger rapid creation and destruction cycles of CQs while EQ events are being processed could exploit this race condition to crash the system or execute arbitrary code with root privileges. This undermines the reliability and security posture of servers utilizing these network interfaces, particularly in environments where dynamic resource allocation is common or under heavy load conditions that increase the likelihood of concurrent access patterns triggering the flaw.
To mitigate this vulnerability, a robust reference counting mechanism was implemented for CQ objects to ensure their lifecycle is managed safely across asynchronous operations. The fix involves taking a reference to the CQ while holding the xarray lock using refcount_inc_not_zero(), which atomically increments the reference count only if the object exists and has not already been marked for destruction. Furthermore, the design ensures that the CQ is removed from the global xarray before dropping the destroy-path reference, thereby preventing new lookups from finding a dangling pointer. Finally, the system waits for all in-flight EQ handlers to complete their processing of the specific CQ before releasing its resources, guaranteeing that no active thread holds a stale reference when memory is freed.
This remediation aligns with industry standards regarding secure resource management and concurrency control. The flaw corresponds to CWE-362, which describes concurrent execution using shared resources with insufficient synchronization. By enforcing strict locking during lookup operations and implementing proper refcounting semantics, the patch addresses the root cause of the race condition. Additionally, from a threat modeling perspective such as MITRE ATT&CK, this vulnerability could be leveraged in techniques related to privilege escalation or defense evasion through kernel exploitation, specifically under tactics like Initial Access if remote triggers are possible, though it is primarily relevant for local attackers seeking to compromise system integrity via CWE-416, use after free. The fix ensures that the kernel maintains memory safety even under high-concurrency scenarios typical of RDMA workloads.