CVE-2026-68417
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A timing flaw in Linux kernel networking code could let a logged-in user crash the system or gain higher privileges on machines that use certain high-speed network hardware.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in siw_create_qp allows QPN lookup to reach a partially constructed RDMA queue pair before queues, CQ pointers, state, completion handlers, and device list entries are initialized.
Why it matters to the business
May cause kernel crashes, memory corruption, or local privilege escalation on systems using RDMA/SIW, disrupting high-performance networking workloads and requiring urgent patching of affected kernels.
How an attack unfolds
A local attacker triggers concurrent QPN lookups against a QP that siw_create_qp has added to the lookup table before full initialization completes, causing use of uninitialized fields.
How to fix it
Update to a kernel containing the fix that moves siw_qp_add to the end of siw_create_qp after all initialization completes.
How to confirm the fix worked
Inspect the siw_create_qp implementation to confirm siw_qp_add occurs after queue, CQ, state, and device list setup; test RDMA QP creation under concurrent lookup load.
Typical attack path
- Obtain local user access on an affected Linux system
- Load or exercise RDMA/SIW drivers
- Concurrently invoke siw_create_qp while performing QPN lookups
- Trigger use of the partially initialized QP structure
How to detect it
Search kernel logs and crash dumps for siw or RDMA QP initialization failures, uninitialized pointer dereferences, or oops traces referencing siw_qp_add or QPN lookup paths.
What your security team should do
- Prioritize kernel updates for systems exposing RDMA interfaces
- Review and restrict local access to RDMA-capable hardware
- Monitor kernel logs for RDMA/SIW related oops or panics
The record
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed. Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|