RDMA/siw: Fix use-after-free in siw_accept() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.16 % · centile 6 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
Références
- https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879
- https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06
- https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735
- https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78
- https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79
- https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5
- https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c
- https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-81885
- GCVE · GCVE-0-2026-90292
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1372 — Multiples vulnérabilités dans les produits SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1335 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < d57db36e74cca4763e1c2c0c6eb9f84d19813879 ; affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < 59de5502f32895ffe9c45530327ed997b90fdf06 ; affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < a89d120615e711ce8fce551fd291c2f387666735 ; affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78 ; affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < 8f286a8094ee32c415f9ecd2c20765beb8a18c79 ; affected 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < de603f01d9ccf823e575b013ffd86ebedca9a8c5 |
| Linux · Linux | affected 5.3 ; unaffected 0 < 5.3 ; unaffected 5.10.270 ≤ 5.10.* ; unaffected 5.15.221 ≤ 5.15.* ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |