---
id: CVE-2026-74345
title: 'RDMA/siw: Fix endpoint/socket association handling'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/siw: Fix endpoint/socket association handling

  Disassociating a socket from an endpoint via siw_socket_disassoc() may
  release the last reference on that endpoint a…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7 <
    b28d513393f81e2de00f82970487a9d001557e4e
  - >-
    Linux >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7 <
    f6183983ce1ff254d629a333739082b39d7c5eb6
  - >-
    Linux >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7 <
    b6cf763eee0a932792bef64ceaca568d324192fc
  - >-
    Linux >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7 <
    ea4f6f6c53577fb3f05dbd78b15e586772d49831
  - Linux 5.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:54:06.183772Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:34.404Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74345'
references:
  - url: 'https://git.kernel.org/stable/c/b28d513393f81e2de00f82970487a9d001557e4e'
  - url: 'https://git.kernel.org/stable/c/f6183983ce1ff254d629a333739082b39d7c5eb6'
  - url: 'https://git.kernel.org/stable/c/b6cf763eee0a932792bef64ceaca568d324192fc'
  - url: 'https://git.kernel.org/stable/c/ea4f6f6c53577fb3f05dbd78b15e586772d49831'
tags:
  - cve.org
epss: 0.00444
epssPercentile: 0.37182
ingestedAt: '2026-10-16T19:46:24.376Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix endpoint/socket association handling

Disassociating a socket from an endpoint via siw_socket_disassoc() may
release the last reference on that endpoint and free it. Therefore, don't
clear the endpoints socket pointer after calling that function, but
within.

This fixes a:

  BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)

which occurred after processing a malformed MPA request during connection
establishment, causing the new endpoint to be closed.

## Affected

- `Linux >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < b28d513393f81e2de00f82970487a9d001557e4e`
- `Linux >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < f6183983ce1ff254d629a333739082b39d7c5eb6`
- `Linux >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < b6cf763eee0a932792bef64ceaca568d324192fc`
- `Linux >= 6c52fdc244b5ccc468006fd65a504d4ee33743c7 < ea4f6f6c53577fb3f05dbd78b15e586772d49831`
- `Linux 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.