CVE-2026-90308

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Hold QP references for AE and CM processing

AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa

and then use or reference them outside the xarray lock.

erdma_destroy_qp() can drop the destroy-path reference and free QP

resources while such a lookup is in flight.

Add erdma_qp_get_by_qpn() to acquire a kref under the xarray

lock with kref_get_unless_zero(). Remove the QP from the xarray

before dropping the destroy-path reference so no new lookup can acquire

it while destruction waits for existing users.