CVE-2026-90292 RDMA/siw: Fix use-after-free in siw_accept()
A use-after-free in the Linux kernel's RDMA/siw module allows attackers to execute arbitrary code or escalate privileges via crafted user-space requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90292?
CVE-2026-90292 is a high-severity use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix use-after-free in siw_accept()
siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it.
The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association.
Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint.
Which versions are affected by CVE-2026-90292?
How do I fix CVE-2026-90292?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90292 being exploited?
There is no known exploitation of CVE-2026-90292 in the wild and no public exploit code.
Sources
Also known as AZL-101888, BELL-CVE-2026-90292, DEBIAN-CVE-2026-90292, GHSA-8qxc-hwhr-6xrv, UBUNTU-CVE-2026-90292.