UBUNTU-CVE-2026-98367: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify->siwqpllpclose did. Otherwise if siwqpmodify() fails in siwaccept(), the QP's statelock is released before the error path cleanup. A concurrent ibvmodifyqp() transitioning the QP to ERROR can race in this window: siwaccept() ibvmodifyqp(ERROR) ---------------------- ---------------------- siwqpmodify() fails upwrite(&qp->statelock) downwrite(&qp->statelock) nextstatefromidle(): if (qp->cep) siwcepput(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF Clear qp->cep and drop the association reference taken by siwcepget(), all under the write lock held from the initial downwrite(&qp->statelock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siwaccept() is done with it.