CVE-2026-68417: RDMA/siw: publish QP after initialization
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: publish QP after initialization
siwcreateqp() currently calls siwqpadd() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed.
Move siwqpadd() to the end of siwcreateqp(), after QP initialization and before adding the QP to the siw device list.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68417?
CVE-2026-68417 has a risk rating of 34, indicating a moderate level of severity.
How do I fix CVE-2026-68417?
To fix CVE-2026-68417, ensure to update your Linux kernel to the latest version where this vulnerability has been addressed.
What systems are affected by CVE-2026-68417?
CVE-2026-68417 affects the Linux kernel where RDMA/siw functionality is implemented.
What is the impact of CVE-2026-68417?
The impact of CVE-2026-68417 includes potential exposure to incorrect behavior when a Queue Pair is published before proper initialization.
Is there a workaround for CVE-2026-68417?
Currently, the recommended approach is to apply the available patch for CVE-2026-68417 rather than relying on any workaround.