KernelScan.io

HIGH

rdma/siw RxFpdu Deref

CVE-2026-23242

CVSS 7.5 / 10.0 NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

KernelScan AI5.5MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereference in header processing If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present. KASAN splat: [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50

02

Engine v0.2.0

Risk summary

Local users with RDMA access can trigger a kernel NULL pointer dereference in the siw (Soft iWarp) driver, causing system crashes. This affects systems using RDMA over Ethernet with the software iWarp implementation.

Affecteddrivers/infiniband/sw/siw/siw_qp_rx.c (RDMA siw)

Vulnerability analysis

The vulnerability occurs in siw_tcp_rx_data() when siw_get_hdr() returns -EINVAL before set_rx_fpdu_context() is called, leaving qp->rx_fpdu as NULL. The error handling path unconditionally dereferences qp->rx_fpdu->more_ddp_segs without checking if rx_fpdu is NULL first. The fix adds a NULL check before accessing the more_ddp_segs field, preventing the crash. This is reachable through RDMA operations that can trigger malformed header processing, requiring local access and RDMA privileges.

03

BranchFixed inPatch commit
5.105.10.252ab61841633d1
5.155.15.2028564dcc12fbb
6.16.1.165ab957056192d
6.126.12.7587b7a036d2c7
6.186.18.14714c99e1dc8f
6.196.19.4ce025f7f5d07
6.66.6.128ffba40b67663
mainline7.014ab3da122bd