CVE-2026-23242

RDMA/siw: Fix potential NULL pointer dereference in header processing

State: Published
Severity: 7.5 High
Published: Mar 18, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix potential NULL pointer dereference in header processing

If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present.

KASAN splat: [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	8b6a361b8c482f22ac99c3273285ff16b23fba91 to before ab61841633d10e56a58c1493a262f0d02dba2f5eAffected 8b6a361b8c482f22ac99c3273285ff16b23fba91 to before 8564dcc12fbb372d984ab45768cae9335777b274Affected 8b6a361b8c482f22ac99c3273285ff16b23fba91 to before ab957056192d6bd068b3759cb2077d859cca01f0Affected 8b6a361b8c482f22ac99c3273285ff16b23fba91 to before ffba40b67663567481fa8a1ed5d2da36897c175dAffected 8b6a361b8c482f22ac99c3273285ff16b23fba91 to before 87b7a036d2c73d5bb3ae2d47dee23de465db3355Affected 8b6a361b8c482f22ac99c3273285ff16b23fba91 to before 714c99e1dc8f85f446e05be02ba83972e981a817Affected 8b6a361b8c482f22ac99c3273285ff16b23fba91 to before ce025f7f5d070596194315eb2e4e89d568b8a755Affected 8b6a361b8c482f22ac99c3273285ff16b23fba91 to before 14ab3da122bd18920ad57428f6cf4fade8385142Affected
LinuxLinux	5.3Affected before 5.3Not affected 5.10.252 through 5.10.Not affected 5.15.202 through 5.15.Not affected 6.1.165 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.14 through 6.18.Not affected 6.19.4 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

8b6a361b8c482f22ac99c3273285ff16b23fba91 to before ab61841633d10e56a58c1493a262f0d02dba2f5eAffected
8b6a361b8c482f22ac99c3273285ff16b23fba91 to before 8564dcc12fbb372d984ab45768cae9335777b274Affected
8b6a361b8c482f22ac99c3273285ff16b23fba91 to before ab957056192d6bd068b3759cb2077d859cca01f0Affected
8b6a361b8c482f22ac99c3273285ff16b23fba91 to before ffba40b67663567481fa8a1ed5d2da36897c175dAffected
8b6a361b8c482f22ac99c3273285ff16b23fba91 to before 87b7a036d2c73d5bb3ae2d47dee23de465db3355Affected
8b6a361b8c482f22ac99c3273285ff16b23fba91 to before 714c99e1dc8f85f446e05be02ba83972e981a817Affected
8b6a361b8c482f22ac99c3273285ff16b23fba91 to before ce025f7f5d070596194315eb2e4e89d568b8a755Affected
8b6a361b8c482f22ac99c3273285ff16b23fba91 to before 14ab3da122bd18920ad57428f6cf4fade8385142Affected

LinuxLinux

5.3Affected
before 5.3Not affected
5.10.252 through 5.10.*Not affected
5.15.202 through 5.15.*Not affected
6.1.165 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.14 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.