CVE-2026-68417RDMA/siw: publish QP after initialization
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed. Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f29dd55b0236f7a26a4b9dd69186e3c04266797b before 3c9d128219964dcea897bf6139b88242e987be8f; from f29dd55b0236f7a26a4b9dd69186e3c04266797b before 3ff82e3841ecab1ff38d5817c969a019d266c83c; from f29dd55b0236f7a26a4b9dd69186e3c04266797b before 36e91a58397ca8c978e38a0bf389f0c6113fa8ca; from f29dd55b0236f7a26a4b9dd69186e3c04266797b before 74912ad168f87d6b2b670a87987bb302d6e64aa1; from f29dd55b0236f7a26a4b9dd69186e3c04266797b before fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d; from f29dd55b0236f7a26a4b9dd69186e3c04266797b before 52f9fcb191143448df55fd215ff09c5207fed43e; from f29dd55b0236f7a26a4b9dd69186e3c04266797b before bb27fcc67c429d97f785c92c35a6c5adebb05d7f | CNA record |
References
- https://git.kernel.org/stable/c/3c9d128219964dcea897bf6139b88242e987be8f
- https://git.kernel.org/stable/c/3ff82e3841ecab1ff38d5817c969a019d266c83c
- https://git.kernel.org/stable/c/36e91a58397ca8c978e38a0bf389f0c6113fa8ca
- https://git.kernel.org/stable/c/74912ad168f87d6b2b670a87987bb302d6e64aa1
- https://git.kernel.org/stable/c/fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d
- https://git.kernel.org/stable/c/52f9fcb191143448df55fd215ff09c5207fed43e
- https://git.kernel.org/stable/c/bb27fcc67c429d97f785c92c35a6c5adebb05d7f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.