CVE-2026-98430

A flaw was found in the Linux kernel's Elastic Fabric Adapter (EFA) driver. The driver enables interrupt request (IRQ) handling before initializing its administrative queues and frees those queues before disabling the interrupt handler. If an interrupt occurs while the queues are uninitialized or already destroyed—such as during device configuration, error handling, or removal—the handler accesses invalid memory. This improper resource management can lead to a system crash, resulting in a Denial of Service (DoS).

The EFA management IRQ handler can access the admin completion queue and async event queue outside their valid lifetime. During device initialization an interrupt can arrive before these queues are fully constructed, while during removal an interrupt can race with queue destruction and dereference freed queue state. The device can also retain queue DMA addresses on an IRQ registration failure, creating a potential DMA access to released memory if the queues are destroyed before the device is reset. This is a race condition with a concrete UAF candidate and a plausible memory corruption path rather than a warning only issue. For the CVSS the PR:L value is used in the paranoid score because a local RDMA user or reduced capability service may generate device activity while reset or removal occurs independently, although reliable direct control of driver teardown normally requires PR:H. AC:H reflects the requirement to hit the IRQ lifetime window. The issue is not demonstrated to be directly network reachable because remote RDMA traffic alone does not provide control over queue destruction or PCI driver removal. Impact is at least local denial of service through a kernel crash and in the worst case may include confidentiality and integrity impact if stale CPU or DMA accesses reach reused memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.