In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs… (CVE-2026-90309)
A high-severity vulnerability in the Linux kernel's RDMA/erdma subsystem was resolved. The issue involved event queue (EQ) handlers accessing completion queues (CQs) without holding proper references, leading to use-after-free conditions. This could allow attackers with local privileges to cause memory corruption or denial of service. The fix introduced reference counting to ensure CQs remain valid while in use by EQ handlers.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's RDMA/erdma component arose because EQ handlers accessed CQs from dev->cq_xa and invoked callbacks outside the xarray lock. Meanwhile, erdma_destroy_cq() could remove and free a CQ while an EQ handler was still using it, causing use-after-free. The patch added a CQ reference count, incremented under the xarray lock, and ensured the CQ is removed from the xarray before releasing resources, waiting for all in-flight EQ users to finish.
Potential Impact
Exploitation could lead to memory corruption, potentially causing denial of service or privilege escalation due to use-after-free conditions in the kernel. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local privileges and low attack complexity.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to remediate the issue. No additional mitigation steps are indicated beyond applying the patch.
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs… (CVE-2026-90309)
Description
A high-severity vulnerability in the Linux kernel's RDMA/erdma subsystem was resolved. The issue involved event queue (EQ) handlers accessing completion queues (CQs) without holding proper references, leading to use-after-free conditions. This could allow attackers with local privileges to cause memory corruption or denial of service. The fix introduced reference counting to ensure CQs remain valid while in use by EQ handlers.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's RDMA/erdma component arose because EQ handlers accessed CQs from dev->cq_xa and invoked callbacks outside the xarray lock. Meanwhile, erdma_destroy_cq() could remove and free a CQ while an EQ handler was still using it, causing use-after-free. The patch added a CQ reference count, incremented under the xarray lock, and ensured the CQ is removed from the xarray before releasing resources, waiting for all in-flight EQ users to finish.
Potential Impact
Exploitation could lead to memory corruption, potentially causing denial of service or privilege escalation due to use-after-free conditions in the kernel. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local privileges and low attack complexity.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to remediate the issue. No additional mitigation steps are indicated beyond applying the patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-p9h2-4fgm-97q7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90309"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade51f55bf5e2cf5edc16d
Added to database: 09/19/2026, 01:27:59 UTC
Last enriched: 09/19/2026, 01:48:39 UTC
Last updated: 09/19/2026, 04:01:35 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.