CVE-2026-74345
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siw_socket_disassoc() may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer after calling that function, but within. This fixes a: BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075) which occurred after processing a malformed MPA request during connection establishment, causing the new endpoint to be closed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74345
EUVD
EUVD-2026-59492

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of endpoint and socket associations in the RDMA/siw driver. When a socket is disassociated from an endpoint, the endpoint may be freed prematurely. This can lead to a use-after-free bug in the siw_cm_work_handler function, causing a kernel crash when processing a malformed MPA request during connection setup.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/siw component and may manifest as a use-after-free bug in siw_cm_work_handler. Detection typically requires kernel logs showing KASAN slab-use-after-free errors related to siw_cm.c. Check system logs for kernel messages indicating memory corruption or crashes in RDMA modules.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited, potentially leading to denial-of-service conditions. Attackers might trigger the flaw by sending specially crafted network requests, causing kernel memory corruption.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, disable the siw RDMA driver by blacklisting the module or restricting its use until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart