GHSA-8QXC-HWHR-6XRV
Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-09-18 18:31In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix use-after-free in siw_accept()
siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it.
The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association.
Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
{
"affected": [],
"aliases": [
"CVE-2026-90292"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:26Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp-\u003ecep is non-NULL and assumes the current\ncall installed the association. However, qp-\u003ecep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp-\u003ecep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep-\u003eqp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp-\u003ecep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint.",
"id": "GHSA-8qxc-hwhr-6xrv",
"modified": "2026-09-18T18:31:29Z",
"published": "2026-09-17T18:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90292"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.