Linux Kernel up to 7.2.7/7.3-rc1/7.3-rc3 RDMA erdma deadlock

Summaryinfo

A vulnerability described as critical has been identified in Linux Kernel up to 7.2.7/7.3-rc1/7.3-rc3. This affects an unknown function of the component RDMA erdma. Executing a manipulation can lead to deadlock. This vulnerability is tracked as CVE-2026-98353. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 7.2.7/7.3-rc1/7.3-rc3 and classified as critical. This vulnerability affects an unknown code block of the component RDMA erdma. The manipulation with an unknown input leads to a deadlock vulnerability. The CWE definition for the vulnerability is CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xa_lock, the lookup spins forever trying to acquire the same lock. Use IRQ-safe XArray helpers for all QP and CQ create-path updates, including the GSI QP store and error paths. Initialize both arrays with XA_FLAGS_LOCK_IRQ so sleeping allocations preserve interrupt state.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-98353 since 09/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/06/2026). This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 7.2.8, 7.3-rc1 or 7.3-rc4 eliminates this vulnerability. Applying the patch 74d4085221a7ec5440996af199ccadfa75b9eb0e/00baeade709fb66da647e8327e8398bb532e30f7 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.3-rc1
• 7.3-rc2
• 7.3-rc3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion