Cloudanix VulnDB

CVE-2026-90292

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's RDMA networking code can let a local user crash the system or run code they should not be able to, so kernels need updating to stay stable and secure.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in siw_accept() due to incorrect reference counting on the incoming CEP when a QP is already in RTS state, allowing the endpoint to be freed before a subsequent store operation.

Why it matters to the business

On Linux systems using RDMA/siw, this can lead to kernel crashes, memory corruption, or potential local code execution, disrupting high-performance networking workloads and requiring urgent patching to maintain system stability.

How an attack unfolds

An attacker with local access triggers siw_accept() on a QP already in RTS state; the error path incorrectly drops a reference from the incoming CEP instead of the existing one, freeing the object prematurely and causing a use-after-free on subsequent access.

How to fix it

Update the Linux kernel to a version containing the fix that only releases the association reference when qp->cep matches the incoming CEP; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the kernel source contains the corrected reference check in siw_accept(); test by exercising siw_accept() paths with pre-RTS QPs and verify no UAF occurs under memory debugging tools such as KASAN.

Typical attack path

  1. Obtain local access on a Linux host with RDMA/siw enabled
  2. Prepare a QP already in RTS state via userspace RDMA operations
  3. Invoke siw_accept() to hit the error cleanup path
  4. Trigger the incorrect reference drop and subsequent freed-object access

How to detect it

Review kernel logs for oops or panic messages referencing siw_accept or use-after-free in RDMA paths; examine audit logs for unusual RDMA QP state transitions from local processes.

What your security team should do

  • Prioritize kernel updates on all systems exposing RDMA/siw interfaces
  • Audit workloads for RDMA usage and restrict unprivileged access where possible
  • Monitor for kernel oops or crashes involving siw_accept after applying the fix

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.

Affected packages

Ecosystem Package Introduced Fixed