RDMA/erdma: Hold CQ references when processing EQ events

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or error callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ from the xarray and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using the CQ. Add a CQ refcount and take a reference under the xarray lock with refcount_inc_not_zero(). Remove the CQ from the xarray before dropping the destroy-path reference, then wait for in-flight EQ users before releasing CQ resources.

Timeline

1. Sep 17, 2026, 4:08 PM UTCCVE published
2. Oct 19, 2026, 9:01 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 155055771704f8cbb5c176a4309b7dc30a50450c · fixed in 610ef81797bb4f709e8675c1d8d093bb9ccdcbd8; From 155055771704f8cbb5c176a4309b7dc30a50450c · fixed in c0a83f29a24c7e7f8516630848ef6db4c174deed; From 155055771704f8cbb5c176a4309b7dc30a50450c · fixed in 05b8ca493dd02319bca93c640b259c2ba51ef321; From 155055771704f8cbb5c176a4309b7dc30a50450c · fixed in 1fc9c1933959d2776a1ce7bf424251b8b5b586cd; From 155055771704f8cbb5c176a4309b7dc30a50450c · fixed in 4545f355654d044d35a31cd01cc46f491a8a7c36; From 155055771704f8cbb5c176a4309b7dc30a50450c · fixed in 98df2aee1459ee1c62c70cbe9b370d2a532aea36

• Linux Linux

  6.0

• KernelLinux

  From 6.0.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 6