CVE-2026-90308

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the RDMA/erdma component where AE QP fatal events and iWARP CM paths load Queue Pairs (QPs) from dev->qp xa and reference them outside the xarray lock. This allows erdma destroy qp() to drop the destroy-path reference and free QP resources while a lookup is still in progress. The fix involves implementing erdma qp get by qpn() to acquire a kref under the xarray lock using kref get unless zero() and removing the QP from the xarray before dropping the destroy-path reference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.