CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix use-after-free in siwaccept()
siwaccept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it.
The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association.
Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The issue is reached when siw_accept() looks up a userspace-supplied queue pair that is already in RTS state and already has an associated connection endpoint. Error cleanup can then release the incoming endpoint incorrectly and later access it after it has been freed.
What is the practical impact on an existing connection?
In addition to the use-after-free of the incoming endpoint, the faulty cleanup can clear the existing queue pair's connection-endpoint association. This can disrupt the existing association while processing the incoming connection.
How does the fix prevent the use-after-free?
The fix releases the association reference only when qp->cep is the incoming connection endpoint. This preserves any pre-existing association and prevents later access to a freed incoming endpoint.