CVE-2026-98367
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did. Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window: siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it.
How to fix
- Linux Linuxf11e09fe2fc3a11ccdf8f932b68181b0bb1d2078, e3f039082856adab7e195dea1af45d93dd6a3f1c, ad50d19f3d1ce052b3a146143581e930a1efb33e, 030306bbb9273af80f14d7af20129661964cd9a7, df2584750314336edcbcc21fb388e04b260f35b7, 9dcc0f4e488b70cff81e0e5717a498c929cf5de3, bfdc744bf20ae4c3ef2e470298de5237c5c9a13c, 32cd87f54dd1070020e664ccb0312a9f0fea79b4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 6c52fdc244b5ccc468006fd65a504d4ee33743c7 ≤ v < f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 ≤ v < e3f039082856adab7e195dea1af45d93dd6a3f1c, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 ≤ v < ad50d19f3d1ce052b3a146143581e930a1efb33e, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 ≤ v < 030306bbb9273af80f14d7af20129661964cd9a7, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 ≤ v < df2584750314336edcbcc21fb388e04b260f35b7, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 ≤ v < 9dcc0f4e488b70cff81e0e5717a498c929cf5de3, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 ≤ v < bfdc744bf20ae4c3ef2e470298de5237c5c9a13c, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 ≤ v < 32cd87f54dd1070020e664ccb0312a9f0fea79b4, 5.3 | f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078, e3f039082856adab7e195dea1af45d93dd6a3f1c, ad50d19f3d1ce052b3a146143581e930a1efb33e, 030306bbb9273af80f14d7af20129661964cd9a7, df2584750314336edcbcc21fb388e04b260f35b7, 9dcc0f4e488b70cff81e0e5717a498c929cf5de3, bfdc744bf20ae4c3ef2e470298de5237c5c9a13c, 32cd87f54dd1070020e664ccb0312a9f0fea79b4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.