CVE-2026-98430

Received Received - Intake

RDMA/efa Kernel Driver Interrupt Handling Flaw

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed them before freeing the IRQ, so the handler's lifetime was not contained by the resources it accesses. Initialize the queues with interrupts masked, request the IRQ, and then switch to interrupt mode. On removal, reset the device and free the IRQ before destroying the queues. Also reset the device before destroying the queues if IRQ registration fails, because the device already has their DMA addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98430

EUVD

EUVD-2026-101079

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	b7f5e880f3774ff1934ce272e1c3b673a3a9c414
Linux	Linux	b7f5e880f3774ff1934ce272e1c3b673a3a9c414
Linux	Linux	b7f5e880f3774ff1934ce272e1c3b673a3a9c414
Linux	Linux	b7f5e880f3774ff1934ce272e1c3b673a3a9c414
Linux	Linux	b7f5e880f3774ff1934ce272e1c3b673a3a9c414
Linux	Linux	b7f5e880f3774ff1934ce272e1c3b673a3a9c414
Linux	Linux	5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of admin queues and IRQ in the RDMA/efa driver. The issue occurs because the management IRQ handler accesses admin completion and async event queues that were not properly initialized before the IRQ was registered. The driver registered the IRQ before constructing these queues and destroyed them before freeing the IRQ, leading to potential use-after-free or invalid memory access scenarios.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/efa driver and involves improper handling of admin queues and IRQ registration. Detection requires checking kernel logs for related errors or examining the driver's state. Commands like dmesg | grep efa or checking /proc/interrupts for IRQ issues may help identify anomalies.

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. It may cause kernel panics or unexpected behavior in systems using the RDMA/efa driver, particularly in environments where remote direct memory access is utilized.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel driver issue involving RDMA/efa IRQ handling. No evidence suggests data privacy or security impacts that would violate these regulations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the RDMA/efa driver if not in use. Monitor kernel logs for any signs of the issue after applying updates.

Hi! I’m here to help you understand CVE-2026-98430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70