Linux kernel RDMA/erdma: completion queue freed while an in-flight EQ handler still references it

Impact

EQ handlers resolve CQs from dev->cq_xa and then call completion or error callbacks after releasing the xarray lock. erdma_destroy_cq() can erase the CQ and free its queue buffer and doorbell record while a previously scheduled EQ handler is still running against it, a use-after-free on freed DMA-visible structures (NVD: 7.8, local, full impact). The fix adds a CQ refcount acquired with refcount_inc_not_zero() under the xarray lock and waits for in-flight EQ users before releasing resources. This is a distinct code path and a distinct fix from the QP refcount issue tracked as CVE-2026-90308, so both patches are needed; it applies only to nodes running Alibaba Cloud Elastic RDMA.

Who can reach it

Local, authenticated: a process or container with an erdma uverbs device that can destroy a CQ while completion or error events for it are still being dispatched. No remote vector; absent on nodes without the erdma driver.

What to do

Update to a stable kernel containing the listed commits and reboot; drain the node first because the affected code is in the RDMA completion path. Nodes without the erdma module need no action. The record names no fixed release, only the stable commits.

References

Related entries

• Linux kernel BPF verifier: load-acquire into its own source register yields pointer type confusionCVE-2026-90312 · Linux kernel BPF verifier (check_atomic_load source pointer type validation)High
• Linux kernel BPF verifier: kptrs stay valid after the final spin unlock ends RCU protectionCVE-2026-90317 · Linux kernel BPF verifier (RCU pointer validity after final bpf_spin_unlock)High
• Linux kernel bpf x86: trampoline under-allocates the save area for __int128 argumentsCVE-2026-90358 · Linux kernel BPF x86 JIT (trampoline register save area for 128-bit arguments)High
• Linux kernel IOMMU DMA: allocation failure not detected in the non-blocking non-coherent pathCVE-2026-90388 · Linux kernel iommu/dma (atomic pool allocation failure check in the non-coherent path)High
• Linux kernel BPF: unprotected link->prog read races bpf_link_update into a use-after-freeCVE-2026-90392 · Linux kernel BPF link info (bpf_link_show_fdinfo / bpf_link_get_info_by_fd prog access)High
• Linux kernel RDMA/rxe: use-after-free when ODP memory-region registration failsCVE-2026-90423 · Linux kernel RDMA/rxe (soft-RoCE, on-demand paging MR init error path)High