CVE-2026-90309

In the Linux kernel, the following vulnerability has been resolved:

RDMA/erdma: Hold CQ references when processing EQ events

EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or

error callbacks outside the xarray lock. erdma_destroy_cq() can erase the

CQ from the xarray and free its queue buffer and doorbell record while a

previously scheduled EQ handler is still using the CQ.

Add a CQ refcount and take a reference under the xarray lock with

refcount_inc_not_zero(). Remove the CQ from the xarray before dropping

the destroy-path reference, then wait for in-flight EQ users before

releasing CQ resources.