Linux Kernel CVE-2026-98323

Exploitation requires the Linux Soft-iWARP driver (siw / rdma_rxe-style soft RDMA) to be loaded and an established iWARP RDMA connection in which the attacker is a connected peer - siw is not loaded in default Linux configurations, which is the primary limiting factor. The attacker must additionally control TCP segmentation so that an extended DDP/RDMAP header is delivered across more than one siw_get_hdr() receive callback, since the bug only manifests when the header spans multiple callbacks and the copy length is miscalculated to hdrlen - MIN_DDP_HDR. No OS-level authentication or user interaction is needed once an RDMA session exists, but the absence of siw on typical servers and the need to craft fragmented header delivery sharply narrow realistic exploitation.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8 CRITICAL) presents this as a remote, unauthenticated, trivially exploitable kernel memory-corruption bug. However, the quantitative threat signals strongly contradict that worst-case framing: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced - so this is 'no public exploit identified at time of analysis.' The low EPSS despite a 9.8 base score is best explained by the narrow attack surface: the flaw lives in the siw (Soft-iWARP) RDMA driver, which is not loaded by default and requires an established iWARP RDMA connection to reach. I disagree with AC:L in the supplied vector - reliably driving fpdu_part_rcvd negative requires the attacker to control TCP segmentation so the extended DDP/RDMAP header arrives split across multiple socket callbacks and to manipulate receive-buffer state, which is non-trivial; AC:H is more defensible (see assessed vector). Net: a genuine critical-severity kernel OOB write worth patching promptly on any host that actually uses Soft-iWARP, but a low real-world-urgency issue for the overwhelming majority of Linux systems that never load the siw module. Treat prioritization as config-dependent rather than fleet-wide.

An attacker who is a peer on an established Soft-iWARP (siw) RDMA connection sends an extended DDP/RDMAP header deliberately fragmented so it spans more than one TCP receive callback. The second callback miscomputes the copy length, writing past the end of the header and corrupting kernel receive state (fpdu_part_rcvd); a subsequent callback then uses the resulting negative value as a copy offset to achieve an out-of-bounds kernel write, enabling memory corruption and potentially code execution. No public exploit code is known, and the attack requires control over how the header is segmented across TCP callbacks.