SB2026100720 - Deadlock in Linux kernel hw erdma driver

Description

This security bulletin contains information about 1 vulnerability.

1) Deadlock (CVE-ID: CVE-2026-98353)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization of XArray locking in the RDMA/erdma driver when event queue interrupts perform queue pair or completion queue lookups during create-path updates. A local user can create queue pairs or completion queues concurrently with these interrupts to cause a denial of service.

The deadlock occurs if an interrupt arrives while the create path holds the same XArray lock needed by the interrupt handler, causing the handler to spin indefinitely.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/00baeade709fb66da647e8327e8398bb532e30f7
• https://git.kernel.org/stable/c/74d4085221a7ec5440996af199ccadfa75b9eb0e