High 7.8Published May 27, 2026

CVE-2026-45910RDMA/rxe: Fix race condition in QP timer handlers

Updated under an hour ago (2026-10-19 11:23 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... libsha1 [last unloaded: ip6_udp_tunnel] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G C 6.19.0-rc5-64k-v8+ #37 PREEMPT Tainted: [C]=CRAP Hardware name: Raspberry Pi 4 Model B Rev 1.2 Call trace: rxe_sched_task+0x1c8/0x238 [rdma_rxe] (P) retransmit_timer+0x130/0x188 [rdma_rxe] call_timer_fn+0x68/0x4d0 __run_timers+0x630/0x888 ... WARNING: drivers/infiniband/sw/rxe/rxe_task.c:38 at rxe_sched_task+0x1c0/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... WARNING: drivers/infiniband/sw/rxe/rxe_task.c:111 at do_work+0x488/0x5c8 [rdma_rxe], CPU#3: kworker/u17:4/93400 ... refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x138/0x1a0, CPU#3: kworker/u17:4/93400 The issue is caused by a race condition between retransmit_timer() and rxe_destroy_qp, leading to the Queue Pair's (QP) reference count dropping to zero during timer handler execution. It seems this warning is harmless because rxe_qp_do_cleanup() will flush all pending timers and requests. Example of flow causing the issue: CPU0 CPU1 retransmit_timer() { spin_lock_irqsave rxe_destroy_qp() __rxe_cleanup() __rxe_put() // qp->ref_count decrease to 0 rxe_qp_do_cleanup() { if (qp->valid) { rxe_sched_task() { WARN_ON(rxe_read(task->qp) <= 0); } } spin_unlock_irqrestore } spin_lock_irqsave qp->valid = 0 spin_unlock_irqrestore } Ensure the QP's reference count is maintained and its validity is checked within the timer callbacks by adding calls to rxe_get(qp) and corresponding rxe_put(qp) after use.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d94671632572813e90bcf475bb4c7d51fbf20173 before 756c93d6df7c3bc599f6590b8e5afead6a41de1c; from d94671632572813e90bcf475bb4c7d51fbf20173 before 3c2ae79fb19dfd67341c14f1e78a5f1744eacfe2; from d94671632572813e90bcf475bb4c7d51fbf20173 before 5ae9da022ee3c97e6469eabcddce9271501ddbad; from d94671632572813e90bcf475bb4c7d51fbf20173 before da379ca16af3722f159860d91a99cb6976a7500f; from d94671632572813e90bcf475bb4c7d51fbf20173 before 87bf646921430e303176edc4eb07c30160361b73	CNA record
linux linux_kernel linux:linux_kernel	from 6.4 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4	NVD

References

https://git.kernel.org/stable/c/756c93d6df7c3bc599f6590b8e5afead6a41de1cpatch
https://git.kernel.org/stable/c/3c2ae79fb19dfd67341c14f1e78a5f1744eacfe2patch
https://git.kernel.org/stable/c/5ae9da022ee3c97e6469eabcddce9271501ddbadpatch
https://git.kernel.org/stable/c/da379ca16af3722f159860d91a99cb6976a7500fpatch
https://git.kernel.org/stable/c/87bf646921430e303176edc4eb07c30160361b73patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.