HIGH Introduced in 5.3
siw Accept UAF
CVE-2026-90292
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
02KernelScan AI Analysis
Risk summary
A local process with access to RDMA devices via the software iWarp (siw) driver can trigger a use-after-free in the connection acceptance path by supplying a QP that is already in a ready-to-send state. This can lead to kernel memory corruption, potentially allowing privilege escalation, information disclosure, or denial of service through a kernel panic.
Vulnerability analysis
In the software iWarp driver's connection acceptance path, error cleanup can occur when an incoming connection is paired with a queue pair that is already active. The cleanup wrongly assumes it created the pairing, so it releases the incoming connection endpoint instead of the one actually paired with the queue pair. This frees the incoming endpoint too early while code still intends to use it, corrupting memory and breaking any existing connection on that queue pair. The fix ensures cleanup only releases the endpoint when it truly belongs to the current incoming connection, preventing premature freeing and preserving active connections. A local process with access to the software iWarp device files can reach this path; no special hardware is required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.3 | 5.10.270 | d57db36e74cc |
| 5.15 | 5.3 | 5.15.221 | 59de5502f328 |
| 6.1 | 5.3 | 6.1.188 | a89d120615e7 |
| 6.12 | 5.3 | 6.12.110 | 8f286a8094ee |
| 6.18 | 5.3 | 6.18.52 | de603f01d9cc |
| 6.6 | 5.3 | 6.6.157 | b9e7d3d9fdb2 |
| 7.2 | 5.3 | 7.2.6 | 561651d6a155 |
| mainline | 5.3 | 7.3 | a93949718259 |
| cip/5.10 | 5.3 | 5.10.271-cip78 | d57db36e74cc |
| cip/6.1 | 5.3 | 6.1.189-cip61 | a89d120615e7 |
| cip/6.1-rt | 5.3 | 6.1.189-cip61-rt32 | a89d120615e7 |
| cip/6.12 | 5.3 | 6.12.111-cip32 | 8f286a8094ee |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |