CVE-2026-68417

RDMA/siw: publish QP after initialization

State: Published
Severity: 7.8 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: publish QP after initialization

siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed.

Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 3c9d128219964dcea897bf6139b88242e987be8fAffected f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 3ff82e3841ecab1ff38d5817c969a019d266c83cAffected f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 36e91a58397ca8c978e38a0bf389f0c6113fa8caAffected f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 74912ad168f87d6b2b670a87987bb302d6e64aa1Affected f29dd55b0236f7a26a4b9dd69186e3c04266797b to before fcc9d50022bcdb1f9f7ed04955c72b4a7355af3dAffected f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 52f9fcb191143448df55fd215ff09c5207fed43eAffected f29dd55b0236f7a26a4b9dd69186e3c04266797b to before bb27fcc67c429d97f785c92c35a6c5adebb05d7fAffected
LinuxLinux	5.3Affected before 5.3Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 3c9d128219964dcea897bf6139b88242e987be8fAffected
f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 3ff82e3841ecab1ff38d5817c969a019d266c83cAffected
f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 36e91a58397ca8c978e38a0bf389f0c6113fa8caAffected
f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 74912ad168f87d6b2b670a87987bb302d6e64aa1Affected
f29dd55b0236f7a26a4b9dd69186e3c04266797b to before fcc9d50022bcdb1f9f7ed04955c72b4a7355af3dAffected
f29dd55b0236f7a26a4b9dd69186e3c04266797b to before 52f9fcb191143448df55fd215ff09c5207fed43eAffected
f29dd55b0236f7a26a4b9dd69186e3c04266797b to before bb27fcc67c429d97f785c92c35a6c5adebb05d7fAffected

LinuxLinux

5.3Affected
before 5.3Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.