CVE-2026-90308

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-90308

Key Details

CVE	CVE-2026-90308
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Hold QP references for AE and CM processing

AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa

and then use or reference them outside the xarray lock.

erdma_destroy_qp() can drop the destroy-path reference and free QP

resources while such a lookup is in flight.

Add erdma_qp_get_by_qpn() to acquire a kref under the xarray

lock with kref_get_unless_zero(). Remove the QP from the xarray

before dropping the destroy-path reference so no new lookup can acquire

it while destruction waits for existing users. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-90308
CVE	https://www.cve.org/CVERecord?id=CVE-2026-90308

Source

Reference

NVD

CVE