Junglewise Threat Intelligence

CVE-2026-23242: Linux Kernel RDMA/siw NULL pointer dereference in header processing

CVE-2026-23242 · Severity: high · CVSS 7.5 · Published 2026-03-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Soft-iWARP (siw) driver, which is used for high-speed data networking. An attacker could potentially trigger a system crash (denial of service) by sending specially crafted network traffic that causes the system to attempt to access invalid memory. This could disrupt operations and affect the availability of servers using RDMA over Ethernet.

Technical details

A NULL pointer dereference exists in the RDMA/siw (Soft-iWARP) driver within the siw_tcp_rx_data() function. The vulnerability occurs when siw_get_hdr() returns an error (such as -EINVAL) before the rx_fpdu context is initialized via set_rx_fpdu_context(). In this scenario, the error handling path attempts to dereference qp->rx_fpdu->more_ddp_segs without verifying if qp->rx_fpdu is NULL. A remote attacker can trigger this condition by sending malformed RDMA over TCP packets, resulting in a kernel panic (KASAN splat confirmed). Patches have been released for multiple stable kernel branches to add the necessary NULL check.

Affected products

  • Linux Linux Kernel 5.3 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.14, 6.19 to 6.19.4

Timeline

  • 2026-03-18: disclosed
  • 2026-03-18: advisory

References