Linux kernel RDMA/siw: use-after-free in siw_accept() when the supplied QP is already in RTS

Impact

siw_accept() looks up a userspace-supplied QP; if that QP is already in RTS it jumps to error cleanup, which assumes qp->cep was installed by this call. qp->cep can instead point at an existing connection's endpoint, so the cleanup drops a reference on the incoming CEP rather than qp->cep, frees it while a later cep->qp store is pending, and also tears down the association of the unrelated live connection. The result is a kernel use-after-free reachable from a local process holding the RDMA device, which NVD scores 7.8 for full confidentiality, integrity and availability loss. Exposure is limited to fleets that actually load the siw software iWARP provider - nodes using hardware RDMA (mlx5, irdma) do not reach this code, and siw is not loaded by default on most distributions.

Who can reach it

Local, authenticated: a user or container with access to an RDMA uverbs device backed by the siw provider, submitting a connection accept against a QP already in RTS. No remote path and no privilege beyond device access is described in the record.

What to do

Update to a stable kernel containing the listed commits and reboot the node. Where siw is not in use, the cheap interim mitigation is to keep the module unloaded and blacklisted (siw) and to ensure tenants are not handed uverbs devices they do not need - that removes the attack surface without a maintenance window. The advisory gives no single fixed release; match the stable branch you run to the corresponding commit.

References

Related entries

• Linux kernel RDMA/erdma: QP freed while async-event and CM handlers still use itCVE-2026-90308 · Linux kernel RDMA/erdma (QP lookup refcounting in AE and iWARP CM paths)High
• Linux kernel RDMA/erdma: completion queue freed while an in-flight EQ handler still references itCVE-2026-90309 · Linux kernel RDMA/erdma (CQ refcounting in EQ event handlers)High
• Linux kernel BPF verifier: load-acquire into its own source register yields pointer type confusionCVE-2026-90312 · Linux kernel BPF verifier (check_atomic_load source pointer type validation)High
• Linux kernel BPF verifier: kptrs stay valid after the final spin unlock ends RCU protectionCVE-2026-90317 · Linux kernel BPF verifier (RCU pointer validity after final bpf_spin_unlock)High
• Linux kernel bpf x86: trampoline under-allocates the save area for __int128 argumentsCVE-2026-90358 · Linux kernel BPF x86 JIT (trampoline register save area for 128-bit arguments)High
• Linux kernel IOMMU DMA: allocation failure not detected in the non-blocking non-coherent pathCVE-2026-90388 · Linux kernel iommu/dma (atomic pool allocation failure check in the non-coherent path)High