Skip to content
Heist/ feed
Back to feed
HighFix available

RDMA/siw: Fix use-after-free in siw_accept()

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.270, 5.15.221, 6.1.188, 6.12.110, 6.18.52, 6.6.157, 7.2.6
CVEs
CVE-2026-90292
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 19:37 UTC · Revision 1

Source evidence

RDMA/siw: Fix use-after-free in siw_accept()

core-osv · Original source

Published 17 Sept 2026, 16:08 UTC

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.

osv:CVE-2026-90292

Kernel

Fixed versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6

Complete source record
{
  "id": "bc889e66d1ef0951f4d04153061a664a2a178375b9292f50f78913b036576407",
  "url": "https://osv.dev/vulnerability/CVE-2026-90292",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "RDMA/siw: Fix use-after-free in siw_accept()",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.",
    "evidence": "osv:CVE-2026-90292",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.270",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.221",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.188",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.157",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.110",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.52",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-90292",
      "aliases": [
        "CVE-2026-90292"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6c52fdc244b5ccc468006fd65a504d4ee33743c7"
                },
                {
                  "fixed": "d57db36e74cca4763e1c2c0c6eb9f84d19813879"
                },
                {
                  "fixed": "59de5502f32895ffe9c45530327ed997b90fdf06"
                },
                {
                  "fixed": "a89d120615e711ce8fce551fd291c2f387666735"
                },
                {
                  "fixed": "b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78"
                },
                {
                  "fixed": "8f286a8094ee32c415f9ecd2c20765beb8a18c79"
                },
                {
                  "fixed": "de603f01d9ccf823e575b013ffd86ebedca9a8c5"
                },
                {
                  "fixed": "561651d6a15588cee2040755f253faca2463415c"
                },
                {
                  "fixed": "a9394971825933074032794a5feee5211509c774"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90292.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.3.0"
                },
                {
                  "fixed": "5.10.270"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.221"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.188"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.157"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.110"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.52"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90292.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.586946010Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c",
        "https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06",
        "https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79",
        "https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735",
        "https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774",
        "https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78",
        "https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879",
        "https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90292.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90292",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90292.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90292",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 506247,
  "published_at": "2026-09-17T16:08:19.35+00:00"
}