Linux kernel CVE-2026-74345

Requires the target to have the siw (software iWARP) kernel module loaded AND an iWARP/RDMA connection listener actively accepting connections that is network-reachable by the attacker; the trigger is a malformed MPA request sent during connection establishment, which drives the new endpoint into its close path. Limiting factors: siw is not loaded in default configurations of most distributions and is used mainly in RDMA-over-TCP/HPC/storage deployments, so hosts without siw or without an exposed iWARP listener are not exploitable regardless of kernel version; no authentication is required once the listener is reachable (PR:N per CVSS), and no user interaction is needed.

Signals conflict sharply. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) implies trivial remote unauthenticated full compromise, but that base score assumes the vulnerable configuration is present and treats a use-after-free as full C/I/A impact. In reality the demonstrated outcome is a kernel crash (DoS) from a malformed MPA request, and exploitation is gated on a niche precondition: the siw module must be loaded and an iWARP connection listener reachable - uncommon outside HPC/storage/RDMA-over-TCP environments. EPSS is low (0.17%, 6th percentile), there is no KEV listing and no public PoC, consistent with low real-world exploitation pressure. No CVSS SSVC/automatable data was provided. Net: treat as a genuine kernel UAF worth patching on RDMA-enabled hosts, but NOT a 9.8-equivalent emergency for the general Linux fleet; the network-vector/high-impact rating is not matched by the demonstrated crash-only behavior - verify weaponizability before prioritizing above other kernel UAFs.

An attacker able to reach a Linux host running the siw software-iWARP driver with an active connection listener opens a connection and sends a malformed MPA request during establishment; the resulting endpoint-close path frees the endpoint and the work handler then dereferences the freed object, triggering a slab use-after-free that crashes the kernel (DoS) and, in principle, could be shaped toward memory corruption. No public exploit code is identified at time of analysis; the KASAN report in the advisory confirms the fault is reliably reachable.