Linux kernel RDMA/erdma: QP freed while async-event and CM handlers still use it

Impact

Asynchronous-event fatal QP handling and the iWARP CM paths load QPs out of dev->qp_xa and then use them after dropping the xarray lock. A concurrent erdma_destroy_qp() can release the destroy-path reference and free QP resources while such a lookup is in flight, giving a use-after-free in the RDMA fast path (NVD: 7.8, local, full impact). The fix adds erdma_qp_get_by_qpn() taking a kref under the xarray lock and removes the QP from the xarray before the destroy reference is dropped. This matters only on nodes running Alibaba Cloud Elastic RDMA; it is a narrow hardware/driver population, but on those nodes RDMA is the training interconnect, so a crash takes the node out of a collective.

Who can reach it

Local, authenticated: a process or container holding an erdma uverbs device that can race QP destruction against connection-management or async-event activity. Not reachable remotely and not reachable on nodes without the erdma driver.

What to do

Move to a stable kernel carrying the listed commits and reboot the affected nodes; drain first, since the bug lives in the data-path driver. If you do not run Elastic RDMA, confirm the erdma module is absent and no action is needed. No fixed distribution version is stated in the record.

References

Related entries

• Linux kernel RDMA/erdma: completion queue freed while an in-flight EQ handler still references itCVE-2026-90309 · Linux kernel RDMA/erdma (CQ refcounting in EQ event handlers)High
• Linux kernel BPF verifier: load-acquire into its own source register yields pointer type confusionCVE-2026-90312 · Linux kernel BPF verifier (check_atomic_load source pointer type validation)High
• Linux kernel BPF verifier: kptrs stay valid after the final spin unlock ends RCU protectionCVE-2026-90317 · Linux kernel BPF verifier (RCU pointer validity after final bpf_spin_unlock)High
• Linux kernel bpf x86: trampoline under-allocates the save area for __int128 argumentsCVE-2026-90358 · Linux kernel BPF x86 JIT (trampoline register save area for 128-bit arguments)High
• Linux kernel IOMMU DMA: allocation failure not detected in the non-blocking non-coherent pathCVE-2026-90388 · Linux kernel iommu/dma (atomic pool allocation failure check in the non-coherent path)High
• Linux kernel BPF: unprotected link->prog read races bpf_link_update into a use-after-freeCVE-2026-90392 · Linux kernel BPF link info (bpf_link_show_fdinfo / bpf_link_get_info_by_fd prog access)High