Look up another CVE · open CVE-2026-90292 in the interactive tracker
CVE-2026-90292
RDMA/siw: Fix use-after-free in siw_accept()
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem drivers/infiniband. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-90292 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/infiniband/sw/siw/siw_cm.c
- What this is
- SOFT-IWARP DRIVER (siw)MAINTAINERS section matched on drivers/infiniband/sw/siw/ · linux-rdma@vger.kernel.org · Supported
- Kernel module
- none to look for. The file would have gone into siw, and Debian does not compile it into that module, so finding siw in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_INFINIBAND|CONFIG_RDMA_SIW' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_INFINIBAND, CONFIG_RDMA_SIW
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/infiniband
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.3 | 5.10.270 | d57db36e74cc |
| 5.3 | 5.15.221 | 59de5502f328 |
| 5.3 | 6.1.188 | a89d120615e7 |
| 5.3 | 6.6.157 | b9e7d3d9fdb2 |
| 5.3 | 6.12.110 | 8f286a8094ee |
| 5.3 | 6.18.52 | de603f01d9cc |
| 5.3 | 7.2.6 | 561651d6a155 |
| 5.3 | 7.3 | a93949718259 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The triggering value is params->qpn of a QP already in RTS, supplied by RDMA_USER_CM_CMD_ACCEPT on /dev/infiniband/rdma_cm (ucma_accept → cma_accept_iw → iw_cm_accept → siw_accept → siw_qp_id2obj). A remote MPA/TCP connect only moves the CEP to SIW_EPSTATE_RECVD_MPAREQ; it does not carry that QPN or RTS state.
- AC:LAttack complexity, low
- After one successful siw_accept() leaves qp->attrs.state at SIW_QP_STATE_RTS with qp->cep set, a second accept of that qpn with id->qp NULL (cma_modify_qp_rtr is a no-op) always takes `if (qp->attrs.state > SIW_QP_STATE_RTR) goto error_unlock`. siw_destroy_cep_sock() then drops the socket kref so the extra siw_cep_put() frees the incoming cep with no race.
- PR:LPrivileges required, low
- ib_uverbs_open() and ucma_open() have no capable() check and both nodes are mode 0666. An unprivileged user can siw_create_qp, rdma_listen on a port ≥1024, loopback-connect, and reach siw_accept; none of those paths require init-namespace root.
- UI:NUser interaction, none
- The attacker issues listen, the loopback connect that yields SIW_EPSTATE_RECVD_MPAREQ, the first accept that puts the QP in RTS, and the second RDMA_USER_CM_CMD_ACCEPT with that qpn; no other user must mount, open, or confirm anything.
- S:UScope, unchanged
- The UAF is of a host-kernel struct siw_cep kfree'd in __siw_cep_dealloc(); resulting slab corruption stays in the same kernel authority and does not cross a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- The extra siw_cep_put() on the incoming cep can run __siw_cep_dealloc()/kfree while cep->qp = NULL and siw_cep_set_free_and_put() still execute. Reclaiming that kmalloc siw_cep discloses kernel memory through the UAF.
- I:HIntegrity impact, high
- The post-free store to cep->qp, the second kref_put in siw_cep_set_free_and_put(), and qp->cep = NULL clearing the live QP association are writes into a reclaimable cep (including saved sk_* callbacks), enabling arbitrary write and control-flow hijack.
- A:HAvailability impact, high
- siw_accept() continues to dereference the incoming cep after the extra put has freed it, and then puts it again, so the kernel oopses or panics even if the slab object is not reused.