PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45910 Linux CVE debrief

A race condition in the Linux kernel's RDMA/rxe (Soft-RoCE) driver can cause use-after-free warnings and reference count underflow during Queue Pair (QP) destruction. The vulnerability exists in the interaction between retransmit_timer() and rxe_destroy_qp(), where the QP's reference count may drop to zero while a timer handler is still executing. The issue manifests as kernel warnings including refcount_t underflow and WARN_ON assertions in rxe_sched_task(). While the source description notes the warning appears harmless due to subsequent cleanup flushing, the fix ensures proper reference counting by adding rxe_get(qp) and rxe_put(qp) calls within timer callbacks to maintain QP validity throughout execution.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux kernel maintainers, organizations running Soft-RoCE (rxe) for RDMA over Ethernet, cloud providers offering RDMA services, and security teams monitoring kernel stability

Technical summary

The RDMA/rxe (Soft-RoCE) driver in the Linux kernel contains a race condition between QP timer handlers and QP destruction. When retransmit_timer() executes concurrently with rxe_destroy_qp(), the QP reference count can reach zero during timer execution, triggering WARN_ON assertions and refcount_t underflow warnings. The fix adds proper reference count management (rxe_get/rxe_put) within timer callbacks to ensure the QP remains valid throughout handler execution.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor kernel logs for WARN_ON messages related to rxe_sched_task or refcount_t underflow in RDMA/rxe operations
  • If running Soft-RoCE (rxe) on affected kernels, consider scheduling maintenance windows for kernel updates
  • Review custom kernel builds using RDMA/rxe for inclusion of the referenced fixes

Evidence notes

The vulnerability is documented through kernel warning traces showing the race condition between CPU0 executing retransmit_timer() and CPU1 executing rxe_destroy_qp(). The fix involves adding proper reference count management in timer handlers. Multiple stable kernel commits are referenced indicating backports to various kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45910 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45910

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45910 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45910

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3c2ae79fb19dfd67341c14f1e78a5f1744eacfe2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5ae9da022ee3c97e6469eabcddce9271501ddbad

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/756c93d6df7c3bc599f6590b8e5afead6a41de1c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/87bf646921430e303176edc4eb07c30160361b73

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/da379ca16af3722f159860d91a99cb6976a7500f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.