EUVD-2026-93352
GHSA-whp9-3996-xqg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to siw RDMA interface
-
DeliveryTrigger siw_accept with failing QP modify
-
ExploitConcurrently call ibv_modify_qp(ERROR) to race
-
ExecutionFree cep in unlocked window
-
PersistDereference freed cep (use-after-free)
-
ImpactCorrupt kernel memory for escalation
Vulnerability Assessment
| Exploitation Conditions | Requires the SoftiWARP (siw) RDMA kernel module to be loaded and reachable by the attacker, plus local access with the ability to issue RDMA/verbs operations (siw_accept via the connection manager and a concurrent ibv_modify_qp to ERROR state). Exploitation is gated on winning a narrow race window in which siw_qp_modify() fails during siw_accept() and state_lock is released before error-path cleanup. Limiting factors: local-only attack vector (no network path), low-privilege local access needed, non-default configuration (siw/RDMA is not loaded on most general-purpose systems), and the inherent unreliability of hitting the race. |
| Impact | This is a local, low-privilege use-after-free (race condition) in the Linux kernel's RDMA/siw (SoftiWARP) driver, triggered when siw_qp_modify() fails inside siw_accept() and a concurrent ibv_modify_qp(ERROR) frees the cep object through a now-unlocked window. The input CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates it HIGH, but the signals collectively point to a moderate real-world priority rather than an emergency: EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit is identified. The attack vector is Local (not network), requires local low privileges, and depends on winning a narrow concurrency race - all of which temper the headline score. One notable tension: the input CVSS uses AC:L, but a use-after-free that depends on a race between two threads realistically requires winning a tight timing window, which argues for AC:H (see assessed vector). Net assessment: a genuine kernel memory-corruption bug worth patching on affected stable trees, but exploitation is hard, unproven, and gated behind the niche siw driver actually being loaded - not a drop-everything issue absent evidence of weaponization. |
| Exploit ScenarioDerived | A local unprivileged-to-low-privileged user with access to the RDMA/siw interface initiates a connection accept (siw_accept) that fails during QP state modification, while a second thread concurrently issues ibv_modify_qp() to the ERROR state, racing into the unlocked window to free the shared cep object. The siw_accept error path then dereferences the freed cep (cep->qp = NULL), corrupting kernel memory; a skilled attacker could attempt to groom the freed slot to escalate privileges. No public exploit code is identified at time of analysis, and winning the race reliably is non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A use-after-free race in the Linux kernel's RDMA/siw (SoftiWARP) driver lets a local, low-privileged user who can issue RDMA verbs operations corrupt kernel memory and potentially escalate privileges or crash the system. The bug is reachable when siw_qp_modify() fails inside siw_accept() and the QP's state_lock is released before the error path clears qp->cep, opening a window in which a concurrent ibv_modify_qp() transition to ERROR frees the same cep object. Exploitation requires the siw module to be loaded and a narrow race to be won, so practical risk is limited to environments using software RDMA; no public exploit code has been identified, EPSS is low (0.17%, 6th percentile), and the issue is not listed in CISA KEV, while vendor patches are available for all supported stable branches.
RemediationAI
Vendor-released patches are available: upgrade the kernel to the fixed stable release for your branch, specifically 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54 or 7.2.8, or to 7.3-rc4 or later on mainline, which incorporate the upstream commits listed at https://git.kernel.org/stable/c/f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078 and the associated stable links, with the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-98367 as a tracking reference. If an immediate kernel update is not possible, the most effective compensating control is to remove the attack surface entirely by unloading the SoftiWARP module ('rmmod rdma_siw') and blacklisting it ('blacklist siw' / 'blacklist rdma_siw' in /etc/modprobe.d), which eliminates the vulnerable code path at the cost of disabling software RDMA over TCP for any application that depends on it; because the vector is AV:L and requires the ability to open RDMA/verbs devices, additionally restricting access to /dev/infiniband/* (for example via device cgroup or file permissions) and monitoring for concurrent siw_accept/ibv_modify_qp activity limits exposure for low-privileged users. Rebooting into the patched kernel is required after installing the update, since the flaw lives in kernel memory management rather than in a restartable userspace service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SoftiWARP (drivers/infiniband/sw/siw) is the Linux kernel's software RDMA implementation, which exposes verbs semantics over ordinary TCP sockets instead of RDMA-capable NIC hardware. The driver tracks each connection endpoint with a 'cep' structure that is reference-counted via siw_cep_get()/siw_cep_put() and linked to a queue pair through qp->cep, all serialized by the QP's rwlock (qp->state_lock). The defect is a locking and lifetime-management error: in siw_accept(), when siw_qp_modify() fails, the code previously released the write lock before the error path cleared the association, unlike siw_qp_llp_close() and the siw_qp_modify() failure path in siw_qp_llp_close, which clear cep inside the lock. A second thread calling ibv_modify_qp() with ERROR reaches nextstate_from_idle(), observes a non-NULL qp->cep, calls siw_cep_put() and frees the cep, after which siw_accept() dereferences the freed pointer. The root-cause class is a race condition leading to use-after-free (CWE-362/CWE-416); the CVSS vector AV:L/AC:H/PR:L indicates local access with high attack complexity and low privileges, and the fix simply moves the 'qp->cep = NULL' and reference drop under the write lock taken at the start of siw_accept(), so the racing thread sees NULL and skips its own put.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local RDMA access needed (AV:L, PR:L); exploitation depends on winning a tight two-thread race, so AC:H; kernel UAF yields full memory-corruption impact (C/I/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did.
Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window:
siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF
Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it.
Executive ViewAI
The Linux kernel's RDMA/siw (SoftiWARP) driver contains a high-severity use-after-free race that could allow a local low-privileged user to corrupt kernel memory, potentially escalating privileges or crashing systems where the siw module is loaded. Exposure is limited to environments using software RDMA, as exploitation requires the siw module to be active and a narrow race to be won; no public exploit identified at time of analysis and EPSS is low. Patch available per vendor advisory, so leadership should prioritize identifying and patching affected software-RDMA hosts while recognizing the practical risk is constrained.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB