Skip to content
Heist/ feed
High

RDMA/siw: Fix use-after-free in siw_accept()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.

Announced Source revision 1
Original source ↗

CVE-2026-90292

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-90292

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
        "lessThan": "d57db36e74cca4763e1c2c0c6eb9f84d19813879",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
        "lessThan": "59de5502f32895ffe9c45530327ed997b90fdf06",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
        "lessThan": "a89d120615e711ce8fce551fd291c2f387666735",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
        "lessThan": "b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
        "lessThan": "8f286a8094ee32c415f9ecd2c20765beb8a18c79",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
        "lessThan": "de603f01d9ccf823e575b013ffd86ebedca9a8c5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
        "lessThan": "561651d6a15588cee2040755f253faca2463415c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
        "lessThan": "a9394971825933074032794a5feee5211509c774",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/infiniband/sw/siw/siw_cm.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.3"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.3",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.270",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.221",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.110",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.52",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/infiniband/sw/siw/siw_cm.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-90292

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#36648 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement