{"api_version":"1","generated_at":"2026-10-01T12:49:25+00:00","cve":"CVE-2026-90292","urls":{"html":"https://cve.report/CVE-2026-90292","api":"https://cve.report/api/cve/CVE-2026-90292.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90292","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90292"},"summary":{"title":"RDMA/siw: Fix use-after-free in siw_accept()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp->cep is non-NULL and assumes the current\ncall installed the association. However, qp->cep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp->cep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep->qp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp->cep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:17:26","updated_at":"2026-09-18 18:17:52"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5","name":"https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774","name":"https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c","name":"https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79","name":"https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06","name":"https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879","name":"https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78","name":"https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735","name":"https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90292","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90292","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 d57db36e74cca4763e1c2c0c6eb9f84d19813879 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 59de5502f32895ffe9c45530327ed997b90fdf06 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 a89d120615e711ce8fce551fd291c2f387666735 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 8f286a8094ee32c415f9ecd2c20765beb8a18c79 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 de603f01d9ccf823e575b013ffd86ebedca9a8c5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 561651d6a15588cee2040755f253faca2463415c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 a9394971825933074032794a5feee5211509c774 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.3","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.270 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.221 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.52 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"90292","cve":"CVE-2026-90292","epss":"0.001600000","percentile":"0.055380000","score_date":"2026-09-21","updated_at":"2026-09-22 00:03:19"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/sw/siw/siw_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d57db36e74cca4763e1c2c0c6eb9f84d19813879","status":"affected","version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","versionType":"git"},{"lessThan":"59de5502f32895ffe9c45530327ed997b90fdf06","status":"affected","version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","versionType":"git"},{"lessThan":"a89d120615e711ce8fce551fd291c2f387666735","status":"affected","version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","versionType":"git"},{"lessThan":"b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78","status":"affected","version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","versionType":"git"},{"lessThan":"8f286a8094ee32c415f9ecd2c20765beb8a18c79","status":"affected","version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","versionType":"git"},{"lessThan":"de603f01d9ccf823e575b013ffd86ebedca9a8c5","status":"affected","version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","versionType":"git"},{"lessThan":"561651d6a15588cee2040755f253faca2463415c","status":"affected","version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","versionType":"git"},{"lessThan":"a9394971825933074032794a5feee5211509c774","status":"affected","version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/sw/siw/siw_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.270","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.52","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.270","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.221","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.52","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp->cep is non-NULL and assumes the current\ncall installed the association. However, qp->cep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp->cep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep->qp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp->cep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The triggering value is params->qpn of a QP already in RTS, supplied by RDMA_USER_CM_CMD_ACCEPT on /dev/infiniband/rdma_cm (ucma_accept → cma_accept_iw → iw_cm_accept → siw_accept → siw_qp_id2obj). A remote MPA/TCP connect only moves the CEP to SIW_EPSTATE_RECVD_MPAREQ; it does not carry that QPN or RTS state.\nAC:L - After one successful siw_accept() leaves qp->attrs.state at SIW_QP_STATE_RTS with qp->cep set, a second accept of that qpn with id->qp NULL (cma_modify_qp_rtr is a no-op) always takes `if (qp->attrs.state > SIW_QP_STATE_RTR) goto error_unlock`. siw_destroy_cep_sock() then drops the socket kref so the extra siw_cep_put() frees the incoming cep with no race.\nPR:L - ib_uverbs_open() and ucma_open() have no capable() check and both nodes are mode 0666. An unprivileged user can siw_create_qp, rdma_listen on a port ≥1024, loopback-connect, and reach siw_accept; none of those paths require init-namespace root.\nUI:N - The attacker issues listen, the loopback connect that yields SIW_EPSTATE_RECVD_MPAREQ, the first accept that puts the QP in RTS, and the second RDMA_USER_CM_CMD_ACCEPT with that qpn; no other user must mount, open, or confirm anything.\nS:U - The UAF is of a host-kernel struct siw_cep kfree'd in __siw_cep_dealloc(); resulting slab corruption stays in the same kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The extra siw_cep_put() on the incoming cep can run __siw_cep_dealloc()/kfree while cep->qp = NULL and siw_cep_set_free_and_put() still execute. Reclaiming that kmalloc siw_cep discloses kernel memory through the UAF.\nI:H - The post-free store to cep->qp, the second kref_put in siw_cep_set_free_and_put(), and qp->cep = NULL clearing the live QP association are writes into a reclaimable cep (including saved sk_* callbacks), enabling arbitrary write and control-flow hijack.\nA:H - siw_accept() continues to dereference the incoming cep after the extra put has freed it, and then puts it again, so the kernel oopses or panics even if the slab object is not reused."}]}],"providerMetadata":{"dateUpdated":"2026-09-18T17:54:21.875Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879"},{"url":"https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06"},{"url":"https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735"},{"url":"https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78"},{"url":"https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79"},{"url":"https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5"},{"url":"https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c"},{"url":"https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774"}],"title":"RDMA/siw: Fix use-after-free in siw_accept()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90292","datePublished":"2026-09-17T16:08:19.350Z","dateReserved":"2026-09-11T19:38:34.798Z","dateUpdated":"2026-09-18T17:54:21.875Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:17:26","lastModifiedDate":"2026-09-18 18:17:52","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90292","Ordinal":"1","Title":"RDMA/siw: Fix use-after-free in siw_accept()","CVE":"CVE-2026-90292","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90292","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp->cep is non-NULL and assumes the current\ncall installed the association. However, qp->cep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp->cep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep->qp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp->cep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint.","Type":"Description","Title":"RDMA/siw: Fix use-after-free in siw_accept()"}]}}}