{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90292","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.798Z","datePublished":"2026-09-17T16:08:19.350Z","dateUpdated":"2026-09-18T17:54:21.875Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-18T17:54:21.875Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp->cep is non-NULL and assumes the current\ncall installed the association. However, qp->cep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp->cep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep->qp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp->cep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The triggering value is params->qpn of a QP already in RTS, supplied by RDMA_USER_CM_CMD_ACCEPT on /dev/infiniband/rdma_cm (ucma_accept → cma_accept_iw → iw_cm_accept → siw_accept → siw_qp_id2obj). A remote MPA/TCP connect only moves the CEP to SIW_EPSTATE_RECVD_MPAREQ; it does not carry that QPN or RTS state.\nAC:L - After one successful siw_accept() leaves qp->attrs.state at SIW_QP_STATE_RTS with qp->cep set, a second accept of that qpn with id->qp NULL (cma_modify_qp_rtr is a no-op) always takes `if (qp->attrs.state > SIW_QP_STATE_RTR) goto error_unlock`. siw_destroy_cep_sock() then drops the socket kref so the extra siw_cep_put() frees the incoming cep with no race.\nPR:L - ib_uverbs_open() and ucma_open() have no capable() check and both nodes are mode 0666. An unprivileged user can siw_create_qp, rdma_listen on a port ≥1024, loopback-connect, and reach siw_accept; none of those paths require init-namespace root.\nUI:N - The attacker issues listen, the loopback connect that yields SIW_EPSTATE_RECVD_MPAREQ, the first accept that puts the QP in RTS, and the second RDMA_USER_CM_CMD_ACCEPT with that qpn; no other user must mount, open, or confirm anything.\nS:U - The UAF is of a host-kernel struct siw_cep kfree'd in __siw_cep_dealloc(); resulting slab corruption stays in the same kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The extra siw_cep_put() on the incoming cep can run __siw_cep_dealloc()/kfree while cep->qp = NULL and siw_cep_set_free_and_put() still execute. Reclaiming that kmalloc siw_cep discloses kernel memory through the UAF.\nI:H - The post-free store to cep->qp, the second kref_put in siw_cep_set_free_and_put(), and qp->cep = NULL clearing the live QP association are writes into a reclaimable cep (including saved sk_* callbacks), enabling arbitrary write and control-flow hijack.\nA:H - siw_accept() continues to dereference the incoming cep after the extra put has freed it, and then puts it again, so the kernel oopses or panics even if the slab object is not reused."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/siw/siw_cm.c"],"versions":[{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"d57db36e74cca4763e1c2c0c6eb9f84d19813879","status":"affected","versionType":"git"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"59de5502f32895ffe9c45530327ed997b90fdf06","status":"affected","versionType":"git"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"a89d120615e711ce8fce551fd291c2f387666735","status":"affected","versionType":"git"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78","status":"affected","versionType":"git"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"8f286a8094ee32c415f9ecd2c20765beb8a18c79","status":"affected","versionType":"git"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"de603f01d9ccf823e575b013ffd86ebedca9a8c5","status":"affected","versionType":"git"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"561651d6a15588cee2040755f253faca2463415c","status":"affected","versionType":"git"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"a9394971825933074032794a5feee5211509c774","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/siw/siw_cm.c"],"versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","status":"unaffected","versionType":"semver"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"5.10.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879"},{"url":"https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06"},{"url":"https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735"},{"url":"https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78"},{"url":"https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79"},{"url":"https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5"},{"url":"https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c"},{"url":"https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774"}],"title":"RDMA/siw: Fix use-after-free in siw_accept()","x_generator":{"engine":"bippy-1.2.0"}}}}