Skip to main content

Linux CVE-2026-23242

| EUVDEUVD-2026-12801 HIGH
NULL Pointer Dereference (CWE-476)
2026-03-18 Linux
Denial Of Service Linux Null Pointer Dereference
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send malformed RDMA packet
  2. Delivery
    Trigger siw_get_hdr() to return -EINVAL
  3. Exploit
    Skip rx_fpdu context initialization
  4. Execution
    Dereference NULL pointer in error path
  5. Impact
    Kernel crash via NULL pointer deref

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Attacker must send malformed RDMA/SIW protocol packets to a Linux system running vulnerable kernel versions with RDMA/SIW (Software iWARP) enabled. Requires network access to the target's RDMA service port. No authentication or victim interaction needed.
Impact

While CVSS and EPSS scores are not provided, the risk assessment can be derived from available signals. This is a kernel null pointer dereference with high technical impact (kernel panic/DoS) but limited exploitability factors. The attack vector requires network access to the RDMA/iWARP service, which is typically restricted to specialized high-performance networking deployments and not universal across all Linux systems. No public exploit code (POC) is indicated, and no KEV status is reported, suggesting this is a defensive patch rather than an actively exploited vulnerability. The fix is straightforward—adding a null check before dereferencing—indicating low attack complexity from the attacker's perspective but high patch feasibility. Real-world risk is elevated for organizations using RDMA/iWARP in data centers and HPC environments but negligible for standard enterprise Linux deployments.
Exploit ScenarioDerived

An attacker with network access to an RDMA/iWARP service receives a specially crafted or malformed TCP packet that triggers siw_get_hdr() to fail with -EINVAL. The error handling path in siw_tcp_rx_data() then attempts to check more_ddp_segs on a null rx_fpdu pointer, causing a kernel null pointer dereference that results in a kernel panic and denial of service. Given the network attack vector but requirement for knowledge of RDMA protocol mechanics, real-world exploitation is limited to adversaries with data center access or those attacking HPC environments specifically configured with iWARP networking.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

A null pointer dereference vulnerability exists in the Linux kernel's RDMA/siw (Software iWARP) module in the TCP receive data path handler. When siw_get_hdr() returns an error before initializing the receive FPDU context, the error handling code attempts to dereference qp->rx_fpdu without null checking, potentially causing a kernel panic and denial of service. The vulnerability affects multiple Linux kernel versions across stable branches (5.10, 5.15, 6.1, 6.6, 6.12, and others) and has been patched across numerous kernel releases.

RemediationAI

Update the Linux kernel to the patched versions as follows: for kernel 5.10, apply patch 5.10.252 or later; for 5.15, apply patch 5.15.202 or later; for 6.1, apply patch 6.1.165 or later; for 6.6, apply patch 6.6.128 or later; for 6.12, apply patch 6.12.75 or later; and for other branches, apply the corresponding released patches. Patch availability is confirmed via git.kernel.org/stable commit references (ab61841633d10e56a58c1493a262f0d02dba2f5e, 8564dcc12fbb372d984ab45768cae9335777b274, and others). Organizations using RDMA/iWARP should prioritize upgrading their kernel versions through their distribution's standard update channels. As a temporary mitigation, restrict network access to RDMA services to trusted sources only and monitor kernel logs for null pointer dereference panics.

Affected VersionsENISA

Linux patch: 6.6.128
Linux 8b6a361b8c482f22ac99c3273285ff16b23fba91 <ce025f7f5d070596194315eb2e4e89d568b8a755
Linux patch: 5.10.252
Linux patch: 6.12.75
Linux 5.3
Linux patch: 7.0-rc1
Linux patch: 6.18.14
Linux patch: 0
Linux patch: 6.1.165
Linux 8b6a361b8c482f22ac99c3273285ff16b23fba91 <ab61841633d10e56a58c1493a262f0d02dba2f5e
Linux patch: 5.15.202
Linux 8b6a361b8c482f22ac99c3273285ff16b23fba91 <ffba40b67663567481fa8a1ed5d2da36897c175d
Linux patch: 6.19.4
Linux 8b6a361b8c482f22ac99c3273285ff16b23fba91 <14ab3da122bd18920ad57428f6cf4fade8385142
Linux 8b6a361b8c482f22ac99c3273285ff16b23fba91 <ab957056192d6bd068b3759cb2077d859cca01f0
Linux 8b6a361b8c482f22ac99c3273285ff16b23fba91 <8564dcc12fbb372d984ab45768cae9335777b274
Linux 8b6a361b8c482f22ac99c3273285ff16b23fba91 <714c99e1dc8f85f446e05be02ba83972e981a817
Linux 8b6a361b8c482f22ac99c3273285ff16b23fba91 <87b7a036d2c73d5bb3ae2d47dee23de465db3355

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability exists in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically in the siw (Software iWARP) driver implementation (CPE: cpe:2.3:a:linux:linux). iWARP is a protocol for RDMA over TCP/IP networks. The vulnerability occurs in the siw_tcp_rx_data() function during header processing in the receive data path. When siw_get_hdr() returns -EINVAL, it indicates a header parsing failure before set_rx_fpdu_context() has executed, leaving qp->rx_fpdu (queue pair receive FPDU context) as NULL. The code then unconditionally accesses the more_ddp_segs field within this null pointer, triggering a CWE-476 null pointer dereference. The root cause is inadequate error path validation failing to verify object initialization state before dereferencing.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 18, 2026 - 10:05 nvd
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix potential NULL pointer dereference in header processing

If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present.

KASAN splat: [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50

Threat Intelligence Overview

EPSS Score
0.0%
Top 94% exploitable
Threat Intel
2
1 source
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in Linux Kernel Memory and Bounds Check Flaws

View all 7
CVE-2026-23243 HIGH
7.8
CVE-2026-23248 HIGH
7.8
CVE-2026-23247 MEDIUM
5.5
CVE-2026-23245 HIGH
7.8
CVE-2026-23244 HIGH
7.1
CVE-2026-23246 HIGH
8.8

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Debian

linux
Release Status Fixed Version Urgency
bullseye vulnerable 5.10.223-1 -
bullseye (security) vulnerable 5.10.251-1 -
bookworm vulnerable 6.1.159-1 -
bookworm (security) vulnerable 6.1.164-1 -
trixie vulnerable 6.12.73-1 -
trixie (security) vulnerable 6.12.74-2 -
forky fixed 6.19.6-2 -
sid fixed 6.19.8-1 -
(unstable) fixed 6.18.14-1 -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04 ICSA-26-295-11
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23242 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/?id.351524 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/14ab3da122bd18920ad57428f6cf4fade8385142 REF https://git.kernel.org/stable/c/714c99e1dc8f85f446e05be02ba83972e981a817 REF https://git.kernel.org/stable/c/8564dcc12fbb372d984ab45768cae9335777b274 REF https://git.kernel.org/stable/c/87b7a036d2c73d5bb3ae2d47dee23de465db3355 REF https://git.kernel.org/stable/c/ab61841633d10e56a58c1493a262f0d02dba2f5e REF https://git.kernel.org/stable/c/ab957056192d6bd068b3759cb2077d859cca01f0 REF https://git.kernel.org/stable/c/ce025f7f5d070596194315eb2e4e89d568b8a755 REF https://git.kernel.org/stable/c/ffba40b67663567481fa8a1ed5d2da36897c175d

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy