Cloudanix VulnDB

CVE-2026-98353

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain high-speed network connections can cause the whole system to freeze when multiple operations happen at once.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition deadlock between EQ interrupt handlers performing locked QP/CQ XArray lookups and create-path updates holding the non-IRQ-safe xa_lock, causing indefinite spin in interrupt context.

Why it matters to the business

Systems relying on RDMA/erdma for high-performance networking or storage may experience kernel hangs or crashes under load, disrupting operations and requiring reboots with potential data loss in flight.

How an attack unfolds

An attacker triggers concurrent RDMA QP or CQ creation while EQ interrupts fire, causing the interrupt handler to contend on the xa_lock held by the create path and deadlock the system.

How to fix it

Update to a Linux kernel containing the fix that initializes QP and CQ XArrays with XA_FLAGS_LOCK_IRQ and uses IRQ-safe helpers for all create-path updates including GSI QP and error paths.

How to confirm the fix worked

Confirm the kernel source uses xa_store_irq and related IRQ-safe helpers for QP/CQ tables and that arrays are initialized with XA_FLAGS_LOCK_IRQ; test under concurrent create and EQ interrupt workloads.

Typical attack path

  1. Gain local access or control over RDMA operations on an affected kernel
  2. Issue QP/CQ creation calls while forcing EQ interrupt activity
  3. Hold xa_lock in create path to collide with IRQ lookup
  4. Induce kernel deadlock or hang

How to detect it

Review kernel logs for soft lockups, deadlocks, or xarray contention traces involving erdma, QP, or CQ; correlate with RDMA create activity in dmesg or ftrace.

What your security team should do

  • Prioritize kernel upgrade for any systems exposing RDMA/erdma interfaces
  • Monitor for kernel oops or soft lockup messages involving xarray or erdma
  • Disable RDMA/erdma if not required until patched
  • Apply updates within standard patch windows given low exploit maturity

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xa_lock, the lookup spins forever trying to acquire the same lock. Use IRQ-safe XArray helpers for all QP and CQ create-path updates, including the GSI QP store and error paths. Initialize both arrays with XA_FLAGS_LOCK_IRQ so sleeping allocations preserve interrupt state.

Affected packages

Ecosystem Package Introduced Fixed