« Volver al listado

CVE-2026-90292

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix use-after-free in siw_accept()

siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it.

The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association.

Leer descripción completaMostrar menos

Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90292",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "d57db36e74cca4763e1c2c0c6eb9f84d19813879",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "59de5502f32895ffe9c45530327ed997b90fdf06",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "a89d120615e711ce8fce551fd291c2f387666735",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "8f286a8094ee32c415f9ecd2c20765beb8a18c79",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "de603f01d9ccf823e575b013ffd86ebedca9a8c5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "561651d6a15588cee2040755f253faca2463415c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
              "lessThan": "a9394971825933074032794a5feee5211509c774",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cm.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cm.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:26.400",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/561651d6a15588cee2040755f253faca2463415c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/59de5502f32895ffe9c45530327ed997b90fdf06",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8f286a8094ee32c415f9ecd2c20765beb8a18c79",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a89d120615e711ce8fce551fd291c2f387666735",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a9394971825933074032794a5feee5211509c774",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b9e7d3d9fdb2bfcfb25d93529fdf766536b37c78",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d57db36e74cca4763e1c2c0c6eb9f84d19813879",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/de603f01d9ccf823e575b013ffd86ebedca9a8c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix use-after-free in siw_accept()\n\nsiw_accept() looks up the QP supplied by userspace. If that QP is\nalready in RTS, the function jumps to error cleanup before associating\nthe incoming CEP with it.\n\nThe cleanup tests whether qp->cep is non-NULL and assumes the current\ncall installed the association. However, qp->cep can point to the CEP\nof an existing connection. The cleanup then drops a reference from the\nincoming cep, not qp->cep. Once the incoming endpoint loses its\nremaining references, this can free it before the subsequent cep->qp\nstore, causing a use-after-free. It also clears the existing QP\nassociation.\n\nOnly release the association reference when qp->cep is the incoming\nCEP. This preserves an existing association and avoids accessing the\nfreed endpoint."
    }
  ],
  "lastModified": "2026-09-18T18:17:52.147",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}