CVE-2026-90292

A flaw was found in the Linux kernel's RDMA/siw component. The siw_accept() function, when handling a Queue Pair (QP) already in the Ready To Send (RTS) state, can incorrectly manage connection endpoints (CEP) during cleanup. This can lead to a use-after-free vulnerability, where a freed memory region is accessed. A local attacker could potentially exploit this to cause a denial of service.

A use after free exists in RDMA siw siw_accept because cleanup checks only whether qp cep is non NULL and assumes the current accept path installed that association. If userspace supplies a QP that is already in RTS, qp cep may refer to an existing connection while the incoming CEP is the object whose reference is dropped. The incoming CEP can then be freed before later use of cep, and the existing QP association may also be cleared incorrectly. For the CVSS the PR:L is selected because reliable triggering requires a local process able to use the RDMA siw accept path and control the supplied QP state. The issue is not directly network reachable by packet traffic alone, although an incoming RDMA connection can be part of the scenario. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact due to kernel use after free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.