In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted

The client borrows shared CQ credits in the ADDR RESOLVED handler via ib cq pool get(), before the peer is connected. create cm() can return -ERESTARTSYS from wait event interruptible timeout() without destroying the CM ID. The init conns() and stop-and-destroy paths then call destroy con cq qp() while cq is still NULL (no PUT) and only afterwards rdma destroy id().

CMA serializes the handler against rdma destroy id() with handler mutex, but that does not order the GET against destroy con cq qp(). If ADDR RESOLVED has already passed the DESTROYING check, it can take con mutex, GET credits, and then lose the con to kfree. Device unregister later hits WARN ON(cq->cqe used) in ib cq pool cleanup().

Set a per-connection flag under con mutex before CQ/QP teardown so a racing ADDR RESOLVED cannot borrow credits after teardown has begun.