All vulnerabilities
CVE-2026-98367

Linux: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in030306bbb9273af80f14d7af20129661964cd9a7Also 9dcc0f4e488b70cff81e0e5717a498c929cf5de3, 32cd87f54dd1070020e664ccb0312a9f0fea79b4CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 030306bbb9273af80f14d7af20129661964cd9a7LinuxCVE List
  • 9dcc0f4e488b70cff81e0e5717a498c929cf5de3LinuxCVE List
  • 32cd87f54dd1070020e664ccb0312a9f0fea79b4LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did.

Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window:

siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF

Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it.

Text from CVE List

Affected versions 18

  • Linuxaffected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 before f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078CVE List
  • Linuxaffected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 before e3f039082856adab7e195dea1af45d93dd6a3f1cCVE List
  • Linuxaffected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 before ad50d19f3d1ce052b3a146143581e930a1efb33eCVE List
  • Linuxaffected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 before 030306bbb9273af80f14d7af20129661964cd9a7CVE List
  • Linuxaffected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 before df2584750314336edcbcc21fb388e04b260f35b7CVE List
  • Linuxaffected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 before 9dcc0f4e488b70cff81e0e5717a498c929cf5de3CVE List
  • Linuxaffected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 before bfdc744bf20ae4c3ef2e470298de5237c5c9a13cCVE List
  • Linuxaffected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 before 32cd87f54dd1070020e664ccb0312a9f0fea79b4CVE List
  • Linuxaffected: 5.3CVE List
  • Linuxunaffected: all versions before 5.3CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8