CVE-2026-98367 - Vulnerability Details

- RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

We need to clear cep before release state_lock as siw_qp_llp_close and
siw_qp_modify->siw_qp_llp_close did.

Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock
is released before the error path cleanup. A concurrent ibv_modify_qp()
transitioning the QP to ERROR can race in this window:

siw_accept() ibv_modify_qp(ERROR)
---------------------- ----------------------
siw_qp_modify() fails
up_write(&qp->state_lock)
down_write(&qp->state_lock)
nextstate_from_idle():
if (qp->cep)
siw_cep_put(qp->cep) <- frees cep
qp->cep = NULL
goto error
cep->qp = NULL <- UAF

Clear qp->cep and drop the association reference taken by siw_cep_get(),
all under the write lock held from the initial down_write(&qp->state_lock).
Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free
the cep before siw_accept() is done with it.

Published: 2026-10-06

Score: n/a

EPSS: n/a

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< e3f039082856adab7e195dea1af45d93dd6a3f1c
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< ad50d19f3d1ce052b3a146143581e930a1efb33e
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< 030306bbb9273af80f14d7af20129661964cd9a7
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< df2584750314336edcbcc21fb388e04b260f35b7
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< 9dcc0f4e488b70cff81e0e5717a498c929cf5de3
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< bfdc744bf20ae4c3ef2e470298de5237c5c9a13c
`6c52fdc244b5ccc468006fd65a504d4ee33743c7`	affected	< 32cd87f54dd1070020e664ccb0312a9f0fea79b4

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3-rc4`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/030306bbb9273af80f14d7af20129661964cd9a7
https://git.kernel.org/stable/c/32cd87f54dd1070020e664ccb0312a9f0fea79b4
https://git.kernel.org/stable/c/9dcc0f4e488b70cff81e0e5717a498c929cf5de3
https://git.kernel.org/stable/c/ad50d19f3d1ce052b3a146143581e930a1efb33e
https://git.kernel.org/stable/c/bfdc744bf20ae4c3ef2e470298de5237c5c9a13c
https://git.kernel.org/stable/c/df2584750314336edcbcc21fb388e04b260f35b7
https://git.kernel.org/stable/c/e3f039082856adab7e195dea1af45d93dd6a3f1c
https://git.kernel.org/stable/c/f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078

History

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did. Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window: siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it.
Title		RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/030306bbb9273af80f14d7af20129661964cd9a7 https://git.kernel.org/stable/c/32cd87f54dd1070020e664ccb0312a9f0fea79b4 https://git.kernel.org/stable/c/9dcc0f4e488b70cff81e0e5717a498c929cf5de3 https://git.kernel.org/stable/c/ad50d19f3d1ce052b3a146143581e930a1efb33e https://git.kernel.org/stable/c/bfdc744bf20ae4c3ef2e470298de5237c5c9a13c https://git.kernel.org/stable/c/df2584750314336edcbcc21fb388e04b260f35b7 https://git.kernel.org/stable/c/e3f039082856adab7e195dea1af45d93dd6a3f1c https://git.kernel.org/stable/c/f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:46:52.452Z

Updated: 2026-10-06T08:46:52.452Z

Reserved: 2026-09-25T10:25:14.344Z

Link: CVE-2026-98367

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:30.970

Modified: 2026-10-06T09:18:30.970

Link: CVE-2026-98367

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object