Strix
64.1K

CVE-2026-90292

HIGHCVSS 7.8/10

Last modified

CVE-2026-90292 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 6c52fdc244b5ccc468006fd65a504d4ee33743c7, < d57db36e74cca4763e1c2c0c6eb9f84d19813879; >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7, < 59de5502f32895ffe9c45530327ed997b90fdf06; >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7, < a89d120615e711ce8fce551fd291c2f387666735; >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7, < b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78; >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7, < 8f286a8094ee32c415f9ecd2c20765beb8a18c79; >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7, < de603f01d9ccf823e575b013ffd86ebedca9a8c5; >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7, < 561651d6a15588cee2040755f253faca2463415c; >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7, < a9394971825933074032794a5feee5211509c774
LinuxLinux5.3

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-90292?
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
How severe is CVE-2026-90292?
CVE-2026-90292 has a CVSS score of 7.8/10 (HIGH severity).
How do I fix CVE-2026-90292?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-90292?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST