CVE-2026-98367
Received Received - Intake

Race Condition in Linux Kernel RDMA/siw QP State Handling

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did. Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window: siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98367
EUVD
EUVD-2026-93352

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 6c52fdc244b5ccc468006fd65a504d4ee33743c7
Linux Linux 6c52fdc244b5ccc468006fd65a504d4ee33743c7
Linux Linux 6c52fdc244b5ccc468006fd65a504d4ee33743c7
Linux Linux 6c52fdc244b5ccc468006fd65a504d4ee33743c7
Linux Linux 6c52fdc244b5ccc468006fd65a504d4ee33743c7
Linux Linux 6c52fdc244b5ccc468006fd65a504d4ee33743c7
Linux Linux 6c52fdc244b5ccc468006fd65a504d4ee33743c7
Linux Linux 6c52fdc244b5ccc468006fd65a504d4ee33743c7
Linux Linux 5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the RDMA/siw module. It occurs when siw_qp_modify fails during siw_accept, causing a race condition where a concurrent operation can free a resource while it is still in use. The issue involves improper handling of the QP's state lock and cep association, leading to a potential use-after-free (UAF) scenario.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/siw driver and requires kernel-level inspection. Detection involves checking for vulnerable kernel versions and examining kernel logs for related errors. Use commands like 'uname -a' to check kernel version and 'dmesg | grep siw' to look for driver-related errors.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (DoS) or execute arbitrary code in the Linux kernel. Systems using the affected RDMA/siw module may crash or become unstable due to the race condition.

Mitigation Strategies

Immediately update the Linux kernel to the latest patched version. If updating is not possible, disable the siw RDMA driver by blacklisting it or unloading the module with 'modprobe -r siw'. Monitor system logs for signs of exploitation or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart