CVE-2026-90292 - Vulnerability Details

- RDMA/siw: Fix use-after-free in siw_accept()

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix use-after-free in siw_accept()

siw_accept() looks up the QP supplied by userspace. If that QP is
already in RTS, the function jumps to error cleanup before associating
the incoming CEP with it.

The cleanup tests whether qp->cep is non-NULL and assumes the current
call installed the association. However, qp->cep can point to the CEP
of an existing connection. The cleanup then drops a reference from the
incoming cep, not qp->cep. Once the incoming endpoint loses its
remaining references, this can free it before the subsequent cep->qp
store, causing a use-after-free. It also clears the existing QP
association.

Only release the association reference when qp->cep is the incoming
CEP. This preserves an existing association and avoids accessing the
freed endpoint.

Published: 2026-09-17

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug arises in the RDMA/siw accept routine when a queue pair that is already in the Ready‑To‑Send state is processed. During error cleanup the code mistakenly drops a reference from the incoming Connection Endpoint rather than the existing QP’s endpoint, which can free that endpoint before it is reused. This sequence can trigger a use‑after‑free that corrupts kernel memory and clears an existing queue‑pair association.

Affected Systems

All Linux kernel releases that include the original siw_accept() implementation in the RDMA/siw subsystem. No specific version range is provided, so any kernel containing this code path is at risk until a kernel update that incorporates the fix is applied.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1 % suggests a low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an untrusted or compromised userspace process that can initiate RDMA connections to the kernel, exercising the vulnerable code path.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< d57db36e74cca4763e1c2c0c6eb9f84d19813879
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< 59de5502f32895ffe9c45530327ed997b90fdf06
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< a89d120615e711ce8fce551fd291c2f387666735
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< 8f286a8094ee32c415f9ecd2c20765beb8a18c79
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< de603f01d9ccf823e575b013ffd86ebedca9a8c5
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< 561651d6a15588cee2040755f253faca2463415c
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< a9394971825933074032794a5feee5211509c774

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,d57db36e74cca4763e1c2c0c6eb9f84d19813879)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,59de5502f32895ffe9c45530327ed997b90fdf06)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,a89d120615e711ce8fce551fd291c2f387666735)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,8f286a8094ee32c415f9ecd2c20765beb8a18c79)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,de603f01d9ccf823e575b013ffd86ebedca9a8c5)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,561651d6a15588cee2040755f253faca2463415c)`	affected	code_commit	—
`[6c52fdc244b5ccc468006fd65a504d4ee33743c7,a9394971825933074032794a5feee5211509c774)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.3`	affected	semver	—
`[0,5.3)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that contains the siw_accept() fix to eliminate the use‑after‑free.
If a kernel update is not immediately available, disable RDMA/siw support by blacklisting or removing the rdma_siwi driver, or block all RDMA traffic to the affected hosts with firewall or network policies.
Enable kernel hardening options such as KASLR, noexec, and stack protection to reduce the impact of any remaining memory corruption.

Generated by OpenCVE AI on September 20, 2026 at 00:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c
https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06
https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79
https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735
https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774
https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78
https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879
https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5

History

Sun, 20 Sep 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
Title		RDMA/siw: Fix use-after-free in siw_accept()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06 https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79 https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735 https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774 https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78 https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879 https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:08:19.350Z

Updated: 2026-09-18T17:54:21.875Z

Reserved: 2026-09-11T19:38:34.798Z

Link: CVE-2026-90292

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:26.400

Modified: 2026-09-18T18:17:52.147

Link: CVE-2026-90292

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T01:00:13Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object