Linux kernel (drivers/infiniband/sw/siw): Soft-iWARP published a new queue pair into the lookup table before its

CVSS 7.8CVE-2026-68417Firmware, BMC & network fabriccurated

Impact

Soft-iWARP published a new queue pair into the lookup table before its queues, completion-queue pointers and state were set up, so a concurrent QP-number lookup reaches a half-built object and follows uninitialised pointers. An attacker who wins the window gets kernel memory corruption from unprivileged userspace.

Who can reach it

An unprivileged process on a node with the siw module loaded creates a QP in one thread while a second thread - or an inbound iWARP segment from a fabric peer that resolves the freshly allocated QP number - looks it up. No hardware RDMA adapter needed, which is exactly why siw is dangerous to leave loaded in tenant containers.

What to do

No fixed version is listed in the record - take the stable kernel carrying 3c9d12821996 (or 3ff82e3841ec / 36e91a58397c) and reboot. Interim: unload and blacklist siw on nodes that do not need soft-iWARP.

References

https://git.kernel.org/stable/c/3c9d128219964dcea897bf6139b88242e987be8f https://git.kernel.org/stable/c/3ff82e3841ecab1ff38d5817c969a019d266c83c https://nvd.nist.gov/vuln/detail/CVE-2026-68417

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.