Executive brief
The Linux kernel's RDMA soft iWARP (siw) driver contains a use-after-free vulnerability in its connection acceptance function. An attacker with local access could exploit this to crash the system or potentially execute code with kernel privileges by triggering a race condition in connection setup logic.
Technical details
The vulnerability is a use-after-free in the siw_accept() function within drivers/infiniband/sw/siw/siw_cm.c. When accepting an incoming RDMA connection, if the Queue Pair (QP) is already in RTS (Ready to Send) state, the error cleanup path incorrectly releases a reference to the incoming Connection Endpoint (CEP) if qp->cep is non-NULL, assuming it was set by the current call. However, qp->cep may already point to an existing connection's CEP. This causes the incoming CEP to be freed while still referenced, and subsequently accesses the freed memory during the cep->qp store operation. The fix changes the condition from `if (qp->cep)` to `if (qp->cep == cep)` to only release the reference when the current call actually set the association, preserving existing connections.
Affected products
- Linux Linux kernel various (patched in stable trees)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Upstream commit a9394971825933074032794a5feee5211509c774