CVE-2026-74345 - Vulnerability Details

- RDMA/siw: Fix endpoint/socket association handling

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix endpoint/socket association handling

Disassociating a socket from an endpoint via siw_socket_disassoc() may
release the last reference on that endpoint and free it. Therefore, don't
clear the endpoints socket pointer after calling that function, but
within.

This fixes a:

BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)

which occurred after processing a malformed MPA request during connection
establishment, causing the new endpoint to be closed.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s RDMA/siw subsystem contains a use‑after‑free flaw: when an endpoint is disassociated from a socket via siw_socket_disassoc(), the final reference may be released and the endpoint freed. If a malformed MPA request is processed during connection establishment, the handler can dereference the now‑dead endpoint, triggering a slab‑use‑after‑free detected by KASAN. This leads to kernel memory corruption that can result in system crashes.

Affected Systems

All Linux distributions that ship kernels lacking the upstream hotfix. The fix is applied in kernel commits visible at the GitHub URLs provided; any kernel older than the commit that introduced the defensive check is vulnerable.

Risk and Exploitability

The flaw is severe, with a CVSS score of 9.8, and it is not listed in the CISA KEV catalog. The EPSS score is < 1%, but because the flaw is activated by network‑received MPA packets, an attacker could potentially craft a malicious RDMA request to trigger the vulnerability, leading to kernel memory corruption and a crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< b28d513393f81e2de00f82970487a9d001557e4e
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< f6183983ce1ff254d629a333739082b39d7c5eb6
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< b6cf763eee0a932792bef64ceaca568d324192fc
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< ea4f6f6c53577fb3f05dbd78b15e586772d49831

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,b28d513393f81e2de00f82970487a9d001557e4e)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,f6183983ce1ff254d629a333739082b39d7c5eb6)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,b6cf763eee0a932792bef64ceaca568d324192fc)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,ea4f6f6c53577fb3f05dbd78b15e586772d49831)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the siw_socket_disassoc patch (commits b28d5 or later).
If an update is unavailable, disable RDMA or block malformed MPA traffic at the network perimeter to prevent the trigger.
Apply stringent kernel memory protection and monitoring to detect signs of kernel crashes.

Generated by OpenCVE AI on August 22, 2026 at 02:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00444.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/b28d513393f81e2de00f82970487a9d001557e4e
https://git.kernel.org/stable/c/b6cf763eee0a932792bef64ceaca568d324192fc
https://git.kernel.org/stable/c/ea4f6f6c53577fb3f05dbd78b15e586772d49831
https://git.kernel.org/stable/c/f6183983ce1ff254d629a333739082b39d7c5eb6
https://lore.kernel.org/linux-cve-announce/2026081558-CVE-2026-74345-c375@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74345
https://www.cve.org/CVERecord?id=CVE-2026-74345

History

Sat, 22 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081558-CVE-2026-74345-c375@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74345 https://www.cve.org/CVERecord?id=CVE-2026-74345
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 17 Aug 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 17 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siw_socket_disassoc() may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer after calling that function, but within. This fixes a: BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075) which occurred after processing a malformed MPA request during connection establishment, causing the new endpoint to be closed.
Title		RDMA/siw: Fix endpoint/socket association handling
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/b28d513393f81e2de00f82970487a9d001557e4e https://git.kernel.org/stable/c/b6cf763eee0a932792bef64ceaca568d324192fc https://git.kernel.org/stable/c/ea4f6f6c53577fb3f05dbd78b15e586772d49831 https://git.kernel.org/stable/c/f6183983ce1ff254d629a333739082b39d7c5eb6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:33.906Z

Updated: 2026-08-17T05:46:10.583Z

Reserved: 2026-08-15T05:44:03.886Z

Link: CVE-2026-74345

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:35.607

Modified: 2026-08-17T06:19:29.070

Link: CVE-2026-74345

Redhat

Severity : Important

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74345 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T03:00:12Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object