CVE-2026-68417 (GCVE-0-2026-68417)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-19 16:35
VLAI
Title
RDMA/siw: publish QP after initialization
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed. Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f29dd55b0236f7a26a4b9dd69186e3c04266797b , < 3c9d128219964dcea897bf6139b88242e987be8f (git)
Affected: f29dd55b0236f7a26a4b9dd69186e3c04266797b , < 3ff82e3841ecab1ff38d5817c969a019d266c83c (git)
Affected: f29dd55b0236f7a26a4b9dd69186e3c04266797b , < 36e91a58397ca8c978e38a0bf389f0c6113fa8ca (git)
Affected: f29dd55b0236f7a26a4b9dd69186e3c04266797b , < 74912ad168f87d6b2b670a87987bb302d6e64aa1 (git)
Affected: f29dd55b0236f7a26a4b9dd69186e3c04266797b , < fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d (git)
Affected: f29dd55b0236f7a26a4b9dd69186e3c04266797b , < 52f9fcb191143448df55fd215ff09c5207fed43e (git)
Affected: f29dd55b0236f7a26a4b9dd69186e3c04266797b , < bb27fcc67c429d97f785c92c35a6c5adebb05d7f (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c9d128219964dcea897bf6139b88242e987be8f",
              "status": "affected",
              "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
              "versionType": "git"
            },
            {
              "lessThan": "3ff82e3841ecab1ff38d5817c969a019d266c83c",
              "status": "affected",
              "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
              "versionType": "git"
            },
            {
              "lessThan": "36e91a58397ca8c978e38a0bf389f0c6113fa8ca",
              "status": "affected",
              "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
              "versionType": "git"
            },
            {
              "lessThan": "74912ad168f87d6b2b670a87987bb302d6e64aa1",
              "status": "affected",
              "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
              "versionType": "git"
            },
            {
              "lessThan": "fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d",
              "status": "affected",
              "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
              "versionType": "git"
            },
            {
              "lessThan": "52f9fcb191143448df55fd215ff09c5207fed43e",
              "status": "affected",
              "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
              "versionType": "git"
            },
            {
              "lessThan": "bb27fcc67c429d97f785c92c35a6c5adebb05d7f",
              "status": "affected",
              "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: publish QP after initialization\n\nsiw_create_qp() currently calls siw_qp_add() before the queues, CQ\npointers, state, completion, and device list entry are ready. A QPN\nlookup can therefore reach a QP that is still being constructed.\n\nMove siw_qp_add() to the end of siw_create_qp(), after QP\ninitialization and before adding the QP to the siw device list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to the RDMA character devices (/dev/infiniband/uverbsN for create_qp and /dev/infiniband/rdma_cm for the QPN lookup); no network packet reaches the racing code path without a local trigger first.\nAC:L - The attacker controls both sides of the race: one thread issues create_qp while another issues rdma_connect/rdma_accept with an attacker-supplied qp_num, and QPNs from xa_alloc(XA_FLAGS_ALLOC1) are predictable. The post-publish failure can be made deterministic by passing a short udata-\u003eoutlen, so the window is wide and repeatable at will.\nPR:L - Any unprivileged local user with access to the siw uverbs and rdma_cm character devices can create QPs and issue rdma_connect/rdma_accept with an arbitrary qp_num; no capability check gates siw_create_qp, siw_connect or siw_accept.\nUI:N - The attacker drives both the QP creation and the concurrent QPN lookup from its own threads; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The siw_qp object can be kfree\u0027d by the ib core error path while the CM thread still holds a reference, giving a use-after-free on a slab object the attacker can groom and read back through QP/CM state, enabling disclosure of arbitrary kernel memory.\nI:H - After the free, siw_free_qp() performs list_del(\u0026qp-\u003edevq), vfree() of four pointer fields and siw_put_tx_cpu(qp-\u003etx_cpu) using values read from reallocated attacker-controlled memory, yielding arbitrary-pointer free, list-unlink writes and out-of-range per-CPU decrements suitable for control-flow hijacking.\nA:H - Even without exploitation the race reliably causes kernel crashes: NULL sendq/recvq/scq/rcq dereferences, list_del on an uninitialized devq head, waits on an uninitialized qp_free completion, and use-after-free oopses."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:15.087Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c9d128219964dcea897bf6139b88242e987be8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ff82e3841ecab1ff38d5817c969a019d266c83c"
        },
        {
          "url": "https://git.kernel.org/stable/c/36e91a58397ca8c978e38a0bf389f0c6113fa8ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/74912ad168f87d6b2b670a87987bb302d6e64aa1"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/52f9fcb191143448df55fd215ff09c5207fed43e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb27fcc67c429d97f785c92c35a6c5adebb05d7f"
        }
      ],
      "title": "RDMA/siw: publish QP after initialization",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68417",
    "datePublished": "2026-08-10T12:04:37.936Z",
    "dateReserved": "2026-07-30T09:28:09.391Z",
    "dateUpdated": "2026-08-19T16:35:15.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68417",
      "date": "2026-09-22",
      "epss": "0.0012",
      "percentile": "0.02123"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/siw/siw_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3c9d128219964dcea897bf6139b88242e987be8f",
                    "status": "affected",
                    "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ff82e3841ecab1ff38d5817c969a019d266c83c",
                    "status": "affected",
                    "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "36e91a58397ca8c978e38a0bf389f0c6113fa8ca",
                    "status": "affected",
                    "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "74912ad168f87d6b2b670a87987bb302d6e64aa1",
                    "status": "affected",
                    "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d",
                    "status": "affected",
                    "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "52f9fcb191143448df55fd215ff09c5207fed43e",
                    "status": "affected",
                    "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bb27fcc67c429d97f785c92c35a6c5adebb05d7f",
                    "status": "affected",
                    "version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/siw/siw_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: publish QP after initialization\n\nsiw_create_qp() currently calls siw_qp_add() before the queues, CQ\npointers, state, completion, and device list entry are ready. A QPN\nlookup can therefore reach a QP that is still being constructed.\n\nMove siw_qp_add() to the end of siw_create_qp(), after QP\ninitialization and before adding the QP to the siw device list."
          }
        ],
        "id": "CVE-2026-68417",
        "lastModified": "2026-08-19T17:20:49.223",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:35.510",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/36e91a58397ca8c978e38a0bf389f0c6113fa8ca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c9d128219964dcea897bf6139b88242e987be8f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3ff82e3841ecab1ff38d5817c969a019d266c83c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/52f9fcb191143448df55fd215ff09c5207fed43e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/74912ad168f87d6b2b670a87987bb302d6e64aa1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bb27fcc67c429d97f785c92c35a6c5adebb05d7f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:27:34+00:00",
      "cve": "CVE-2026-68417",
      "id": "CVE-2026-68417",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "121",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/siw: publish QP after initialization",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68417.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:30:28Z",
      "cve": "CVE-2026-68417",
      "id": "CVE-2026-68417",
      "initial_release_date": "2026-08-11T23:45:59Z",
      "product_status:first_fixed": "104",
      "product_status:known_affected": "622",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68417",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68417.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.