Cloudanix VulnDB

CVE-2026-98429

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing error in low-level networking hardware handling could let the system crash or behave unexpectedly during certain network operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Race condition allowing IRQ handler to access uninitialized or freed EQ state and DMA buffers due to incorrect ordering of IRQ registration versus resource initialization and teardown.

Why it matters to the business

Potential system instability, crashes, or denial of service on systems using RDMA networking, with possible escalation risks in high-privilege kernel contexts; low immediate urgency given minimal exploitation signals.

How an attack unfolds

An attacker with local access or ability to trigger RDMA operations races the EQ initialization and IRQ handler teardown sequence, causing the handler to dereference invalid memory during completion processing.

How to fix it

Apply the upstream kernel patch that initializes the EQ un-armed, registers the IRQ, then arms it, and reverses teardown order by freeing the IRQ before EQ destruction; upgrade to a Linux kernel containing this fix once released.

How to confirm the fix worked

Inspect kernel source for the reordered EQ/IRQ initialization sequence in drivers/infiniband/hw/efa; verify running kernel version includes the commit or test RDMA device attach/detach under load for stability.

Typical attack path

  1. Trigger RDMA/efa device initialization or connection setup
  2. Force concurrent IRQ registration and EQ resource allocation
  3. Initiate rapid teardown or device removal to race buffer release with handler execution
  4. Observe or exploit resulting invalid memory access in the completion IRQ path

How to detect it

Search kernel logs and crash dumps for RDMA/efa EQ or IRQ handler faults during device initialization or removal; correlate with RDMA workload activity.

What your security team should do

  • Monitor for kernel updates addressing RDMA/efa race conditions
  • Restrict unprivileged RDMA access where possible until patched
  • Review system logs for related oops or warnings on RDMA-enabled hosts

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources alive while IRQ is registered The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before free_irq() synchronized the handler. Initialize the EQ without arming it, register the IRQ, and then arm it. Reverse the resource order during teardown by freeing the IRQ before destroying the EQ.

Affected packages

Ecosystem Package Introduced Fixed