The vulnerability (CVE-2026-90308) in the Linux kernel's RDMA/erdma component arises from holding Queue Pair (QP) references improperly during AE and CM processing. Fatal AE QP events and iWARP CM paths load QPs from dev->qp_xa and reference them outside the protection of the xarray lock. Meanwhile, erdma_destroy_qp() can drop the destroy-path reference and free QP resources while a lookup is still in progress, leading to potential use-after-free issues. The patch adds erdma_qp_get_by_qpn() to acquire a kernel reference (kref) under the xarray lock using kref_get_unless_zero(), and removes the QP from the xarray before dropping the destroy-path reference, ensuring no new lookups can acquire the QP during destruction.

This vulnerability can lead to use-after-free conditions in the Linux kernel RDMA/erdma subsystem, potentially causing system crashes, data corruption, or privilege escalation due to improper memory handling. The CVSS score of 7.8 indicates high severity with impacts on confidentiality, integrity, and availability.

A fix has been implemented to address this vulnerability by modifying the reference handling of QPs in the RDMA/erdma code. Users should apply the official Linux kernel patches that include these changes to ensure protection. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is confirmed by the resolved description; no additional mitigation steps are indicated.