Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation): A malformed MPA request during

Impact

A malformed MPA request during iWARP connection setup causes the new endpoint to be torn down, and siw_socket_disassoc() drops the last reference and frees the endpoint while the caller then clears the now-dangling socket pointer. KASAN caught the use-after-free in the connection-manager work handler. The whole sequence happens during connection establishment, so it is reachable before any application-level authentication - a remote peer that can reach the siw listener gets a kernel use-after-free by sending a deliberately broken handshake.

Who can reach it

Remote, pre-authentication. Anyone who can complete a TCP connection to the SoftiWARP listening port on the node - which on a flat cluster network is every other tenant's workload.

What to do

Kernel update moving the socket-pointer clear inside siw_socket_disassoc(). Because siw is a loadable software provider, unloading or blacklisting the siw module on nodes that do not need SoftiWARP eliminates the listener immediately, no reboot required - do that first, patch on the next maintenance window.

References