Database/Kernel, userspace & hypervisor
Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation): A malformed MPA request during
Impact
A malformed MPA request during iWARP connection setup causes the new endpoint to be torn down, and siw_socket_disassoc() drops the last reference and frees the endpoint while the caller then clears the now-dangling socket pointer. KASAN caught the use-after-free in the connection-manager work handler. The whole sequence happens during connection establishment, so it is reachable before any application-level authentication - a remote peer that can reach the siw listener gets a kernel use-after-free by sending a deliberately broken handshake.
Who can reach it
Remote, pre-authentication. Anyone who can complete a TCP connection to the SoftiWARP listening port on the node - which on a flat cluster network is every other tenant's workload.
What to do
Kernel update moving the socket-pointer clear inside siw_socket_disassoc(). Because siw is a loadable software provider, unloading or blacklisting the siw module on nodes that do not need SoftiWARP eliminates the listener immediately, no reboot required - do that first, patch on the next maintenance window.
References
Related entries
- Linux kernel (drivers/nvme/host): An off-by-one in the Flexible Data Placement index check accepts a placement indexCVE-2026-74361 · Linux kernel (drivers/nvme/host)Critical
- Linux kernel (drivers/nvme/host): The multipath current-path array is sized by the count of possible NUMA nodes butCVE-2026-74384 · Linux kernel (drivers/nvme/host)Critical
- Linux kernel (net/smc): Link-group termination drops conns_lock after finding a connection but before taking a socketCVE-2026-74493 · Linux kernel (net/smc)Critical
- Linux kernel - iSCSI TCP initiator, drivers/scsi/libiscsi_tcp.c: The iSCSI initiator receives PDU data segments into aCVE-2026-74556 · Linux kernel - iSCSI TCP initiator, drivers/scsi/libiscsi_tcp.cCritical
- Linux kernel net/smc: unlocked bitfield sharing corrupts SMC connection state flagsCVE-2026-80980 · Linux kernel net/smc (smc_connection killed/freed/out_of_sync bitfields)Critical
- Linux kernel SMC-R: use-after-free of the LLC queue entry when adding a second RDMA linkCVE-2026-80981 · Linux kernel net/smc (smc_llc_srv_add_link LLC qentry lifetime)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.