CVE-2026-90292 (GCVE-0-2026-90292)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
RDMA/siw: Fix use-after-free in siw_accept()
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < d57db36e74cca4763e1c2c0c6eb9f84d19813879 (git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 59de5502f32895ffe9c45530327ed997b90fdf06 (git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < a89d120615e711ce8fce551fd291c2f387666735 (git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78 (git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 8f286a8094ee32c415f9ecd2c20765beb8a18c79 (git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < de603f01d9ccf823e575b013ffd86ebedca9a8c5 (git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 561651d6a15588cee2040755f253faca2463415c (git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < a9394971825933074032794a5feee5211509c774 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d57db36e74cca4763e1c2c0c6eb9f84d19813879",
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "versionType": "git"
            },
            {
              "lessThan": "59de5502f32895ffe9c45530327ed997b90fdf06",
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "versionType": "git"
            },
            {
              "lessThan": "a89d120615e711ce8fce551fd291c2f387666735",
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "versionType": "git"
            },
            {
              "lessThan": "b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78",
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "versionType": "git"
            },
            {
              "lessThan": "8f286a8094ee32c415f9ecd2c20765beb8a18c79",
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "versionType": "git"
            },
            {
              "lessThan": "de603f01d9ccf823e575b013ffd86ebedca9a8c5",
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "versionType": "git"
            },
            {
              "lessThan": "561651d6a15588cee2040755f253faca2463415c",
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "versionType": "git"
            },
            {
              "lessThan": "a9394971825933074032794a5feee5211509c774",
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp-\u003ecep is non-NULL and assumes the current\ncall installed the association. However, qp-\u003ecep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp-\u003ecep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep-\u003eqp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp-\u003ecep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The triggering value is params-\u003eqpn of a QP already in RTS, supplied by RDMA_USER_CM_CMD_ACCEPT on /dev/infiniband/rdma_cm (ucma_accept \u2192 cma_accept_iw \u2192 iw_cm_accept \u2192 siw_accept \u2192 siw_qp_id2obj). A remote MPA/TCP connect only moves the CEP to SIW_EPSTATE_RECVD_MPAREQ; it does not carry that QPN or RTS state.\nAC:L - After one successful siw_accept() leaves qp-\u003eattrs.state at SIW_QP_STATE_RTS with qp-\u003ecep set, a second accept of that qpn with id-\u003eqp NULL (cma_modify_qp_rtr is a no-op) always takes `if (qp-\u003eattrs.state \u003e SIW_QP_STATE_RTR) goto error_unlock`. siw_destroy_cep_sock() then drops the socket kref so the extra siw_cep_put() frees the incoming cep with no race.\nPR:L - ib_uverbs_open() and ucma_open() have no capable() check and both nodes are mode 0666. An unprivileged user can siw_create_qp, rdma_listen on a port \u22651024, loopback-connect, and reach siw_accept; none of those paths require init-namespace root.\nUI:N - The attacker issues listen, the loopback connect that yields SIW_EPSTATE_RECVD_MPAREQ, the first accept that puts the QP in RTS, and the second RDMA_USER_CM_CMD_ACCEPT with that qpn; no other user must mount, open, or confirm anything.\nS:U - The UAF is of a host-kernel struct siw_cep kfree\u0027d in __siw_cep_dealloc(); resulting slab corruption stays in the same kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The extra siw_cep_put() on the incoming cep can run __siw_cep_dealloc()/kfree while cep-\u003eqp = NULL and siw_cep_set_free_and_put() still execute. Reclaiming that kmalloc siw_cep discloses kernel memory through the UAF.\nI:H - The post-free store to cep-\u003eqp, the second kref_put in siw_cep_set_free_and_put(), and qp-\u003ecep = NULL clearing the live QP association are writes into a reclaimable cep (including saved sk_* callbacks), enabling arbitrary write and control-flow hijack.\nA:H - siw_accept() continues to dereference the incoming cep after the extra put has freed it, and then puts it again, so the kernel oopses or panics even if the slab object is not reused."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:21.875Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879"
        },
        {
          "url": "https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06"
        },
        {
          "url": "https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79"
        },
        {
          "url": "https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774"
        }
      ],
      "title": "RDMA/siw: Fix use-after-free in siw_accept()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90292",
    "datePublished": "2026-09-17T16:08:19.350Z",
    "dateReserved": "2026-09-11T19:38:34.798Z",
    "dateUpdated": "2026-09-18T17:54:21.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90292",
      "date": "2026-09-25",
      "epss": "0.00171",
      "percentile": "0.0571"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:13:46.000Z",
      "cve": "CVE-2026-90292",
      "id": "msrc_CVE-2026-90292",
      "initial_release_date": "2026-09-19T01:04:49.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/siw: Fix use-after-free in siw_accept()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90292.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/siw/siw_cm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d57db36e74cca4763e1c2c0c6eb9f84d19813879",
                    "status": "affected",
                    "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "59de5502f32895ffe9c45530327ed997b90fdf06",
                    "status": "affected",
                    "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a89d120615e711ce8fce551fd291c2f387666735",
                    "status": "affected",
                    "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78",
                    "status": "affected",
                    "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8f286a8094ee32c415f9ecd2c20765beb8a18c79",
                    "status": "affected",
                    "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de603f01d9ccf823e575b013ffd86ebedca9a8c5",
                    "status": "affected",
                    "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "561651d6a15588cee2040755f253faca2463415c",
                    "status": "affected",
                    "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a9394971825933074032794a5feee5211509c774",
                    "status": "affected",
                    "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/siw/siw_cm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp-\u003ecep is non-NULL and assumes the current\ncall installed the association. However, qp-\u003ecep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp-\u003ecep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep-\u003eqp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp-\u003ecep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint."
          }
        ],
        "id": "CVE-2026-90292",
        "lastModified": "2026-09-18T18:17:52.147",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:26.400",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.