---
id: CVE-2026-31492
title: 'RDMA/irdma: Initialize free_qp completion before using it'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/irdma: Initialize free_qp completion before using it

  In irdma_create_qp, if ib_copy_to_udata fails, it will call
  irdma_destroy_qp to clean up which will attempt t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    ac1da7bd224d406b6f1b84414f0f652ab43b6bd8
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    af310407f79d5816fc0ab3638e1588b6193316dd
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    cd1534c8f4984432382c240f6784408497f5bb0a
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    3cb88c12461b71c7d9c604aa2e6a9a477ecfa147
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    f72996834f7bdefc2b95e3eec30447ee195df44e
  - >-
    Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 <
    11a95521fb93c91e2d4ef9d53dc80ef0a755549b
  - Linux 5.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:35:11.846841Z'
published: '2026-04-22'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:45:02.074Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31492'
references:
  - url: 'https://git.kernel.org/stable/c/ac1da7bd224d406b6f1b84414f0f652ab43b6bd8'
  - url: 'https://git.kernel.org/stable/c/af310407f79d5816fc0ab3638e1588b6193316dd'
  - url: 'https://git.kernel.org/stable/c/cd1534c8f4984432382c240f6784408497f5bb0a'
  - url: 'https://git.kernel.org/stable/c/3cb88c12461b71c7d9c604aa2e6a9a477ecfa147'
  - url: 'https://git.kernel.org/stable/c/f72996834f7bdefc2b95e3eec30447ee195df44e'
  - url: 'https://git.kernel.org/stable/c/11a95521fb93c91e2d4ef9d53dc80ef0a755549b'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02043
ingestedAt: '2026-11-05T23:41:31.983Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Initialize free_qp completion before using it

In irdma_create_qp, if ib_copy_to_udata fails, it will call
irdma_destroy_qp to clean up which will attempt to wait on
the free_qp completion, which is not initialized yet. Fix this
by initializing the completion before the ib_copy_to_udata call.

## Affected

- `Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 < ac1da7bd224d406b6f1b84414f0f652ab43b6bd8`
- `Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 < af310407f79d5816fc0ab3638e1588b6193316dd`
- `Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 < cd1534c8f4984432382c240f6784408497f5bb0a`
- `Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 < 3cb88c12461b71c7d9c604aa2e6a9a477ecfa147`
- `Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 < f72996834f7bdefc2b95e3eec30447ee195df44e`
- `Linux >= b48c24c2d710cf34810c555dcef883a3d35a9c08 < 11a95521fb93c91e2d4ef9d53dc80ef0a755549b`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.