CVE-2026-90292

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the RDMA/siw component within the siw accept() function. The function looks up a Queue Pair (QP) provided by userspace; if the QP is already in Ready to Send (RTS) state, the function triggers error cleanup before associating the incoming Connection Endpoint (CEP) with it. The cleanup process incorrectly assumes that any non-NULL qp->cep was installed by the current call, leading to the dropping of a reference from the incoming CEP instead of the existing one. This can result in the incoming endpoint being freed while still being accessed, and it also clears the existing QP association.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.