CVE-2026-90292

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:26.400000

Last modified

2026-10-19 09:19:22.957000

View original CVE JSON

{
  "id": "CVE-2026-90292",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:26.400",
  "lastModified": "2026-10-19T09:19:22.957",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp->cep is non-NULL and assumes the current\ncall installed the association. However, qp->cep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp->cep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep->qp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp->cep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "d57db36e74cca4763e1c2c0c6eb9f84d19813879",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "59de5502f32895ffe9c45530327ed997b90fdf06",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "a89d120615e711ce8fce551fd291c2f387666735",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "8f286a8094ee32c415f9ecd2c20765beb8a18c79",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "de603f01d9ccf823e575b013ffd86ebedca9a8c5",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "561651d6a15588cee2040755f253faca2463415c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "a9394971825933074032794a5feee5211509c774",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.3",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.3",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.270",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.221",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}