CVE-2026-98353 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xa_lock, the lookup spins forever trying to acquire the same lock.
Use IRQ-safe XArray helpers for all QP and CQ create-path updates, including the GSI QP store and error paths. Initialize both arrays with XA_FLAGS_LOCK_IRQ so sleeping allocations preserve interrupt state.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel's RDMA/erdma driver contained a critical concurrency flaw involving improper lock usage during queue pair and completion queue table management. This vulnerability manifests as a potential deadlock scenario arising from the interaction between interrupt handlers and process context operations. Specifically, locked lookups of Queue Pairs (QP) and Completion Queues (CQ) initiated within Ethernet RDMA (erdma) Event Queue interrupts were found to be incompatible with create-path updates that utilize standard XArray locking mechanisms. When an event queue interrupt arrives while the kernel is in the process of creating a path, it attempts to acquire the plain xa_lock for lookup purposes. However, if this creation operation already holds the same lock without allowing for preemption or safe interruption handling, the interrupt handler will spin indefinitely waiting for the lock release that can never occur due to the blocking nature of the current context. This results in a system hang where CPU resources are consumed by spinning threads unable to make progress, effectively causing a denial of service condition within the affected kernel subsystem.
This issue is classified under CWE-833, which denotes Deadlock conditions resulting from improper resource locking strategies. The root cause lies in the failure to distinguish between contexts that can sleep and those that must execute atomically without holding locks that might be held by interrupt handlers. In Linux kernel development, standard XArray operations using xa_lock are not safe for use within hard interrupt context if they may block or contend with interrupts that also require that lock. The erdma driver incorrectly assumed that the lookup paths were immune to this contention, failing to account for the possibility of nested locking scenarios where an interrupt preempts a critical section holding the same synchronization primitive. This oversight violates fundamental kernel concurrency principles regarding lock ordering and context safety, leading to unpredictable system stability issues under specific timing conditions involving high event rates during resource creation.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1499, specifically Endpoint Denial of Service via service disruption or exhaustion. Although the primary impact is local rather than remote exploitation in most typical configurations, an attacker with local access could potentially trigger rapid queue pair creations to induce the deadlock condition, thereby freezing kernel threads and degrading system availability. The operational impact includes complete unresponsiveness of the RDMA subsystem and potential cascading failures affecting other kernel components that depend on stable interrupt handling. Such deadlocks can lead to panic conditions or require manual intervention via hard resets, impacting business continuity for workloads relying on high-performance networking capabilities provided by RDMA technologies.
To mitigate this vulnerability, the Linux kernel maintainers have implemented a fix that utilizes IRQ-safe XArray helpers for all Queue Pair and Completion Queue table updates. This includes modifications to the GSI QP store logic as well as error handling paths within the create-path operations. The core technical adjustment involves initializing both arrays with the XA_FLAGS_LOCK_IRQ flag, which configures the underlying synchronization primitives to handle interrupt context safely. By ensuring that sleeping allocations preserve interrupt state and that lookups do not contend improperly with update locks held in process context, the deadlock condition is eliminated. System administrators should apply kernel updates containing this patch immediately to restore stability to RDMA-enabled systems. Additionally, developers working on similar subsystems should audit their use of XArray structures to ensure appropriate lock variants are selected based on execution context, adhering strictly to kernel locking best practices to prevent future occurrences of such concurrency-related deadlocks.