Cloudanix VulnDB

CVE-2026-98367

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux kernel networking code could let a logged-in user crash the machine or possibly take control of it.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in RDMA/siw driver during siw_accept failure path allows concurrent ibv_modify_qp(ERROR) to free cep pointer after state_lock is released, resulting in use-after-free when the original path dereferences the now-invalid cep.

Why it matters to the business

Local attackers on RDMA-enabled Linux systems can trigger kernel memory corruption, leading to crashes, data corruption, or potential privilege escalation; affects high-performance computing and storage clusters using iWARP.

How an attack unfolds

An attacker with local access triggers the siw_accept path so that siw_qp_modify fails, releases state_lock, then races a second thread performing ibv_modify_qp to ERROR; the second thread frees the cep while the first thread later writes to it, causing UAF.

How to fix it

Apply the upstream kernel commit that clears the cep association under the held state_lock before releasing it on siw_qp_modify failure; rebuild and deploy the patched kernel across all affected hosts.

How to confirm the fix worked

Confirm the fix is present by inspecting the siw_accept function for the cep clearing block performed under the write lock; run targeted RDMA regression tests that exercise the accept/modify error path.

Typical attack path

  1. Obtain local user access on a system with siw RDMA driver loaded
  2. Initiate RDMA connection that reaches siw_accept
  3. Force siw_qp_modify to fail inside siw_accept
  4. Concurrently issue ibv_modify_qp transition to ERROR state
  5. Trigger dereference of the freed cep structure

How to detect it

Search kernel logs and crash dumps for stack traces containing siw_accept, siw_qp_modify, and references to cep or state_lock around the time of a use-after-free or general protection fault.

What your security team should do

  • Patch RDMA-enabled kernels within the next maintenance window given the 17-day public disclosure
  • Restrict local access on systems exposing RDMA interfaces until patched
  • Monitor kernel logs for siw-related use-after-free warnings
  • Review downstream package distributions for backported fixes

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did. Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window: siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it.

Affected packages

Ecosystem Package Introduced Fixed