CVE-2026-90292

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix use-after-free in siw_accept()

siw_accept() looks up the QP supplied by userspace. If that QP is

already in RTS, the function jumps to error cleanup before associating

the incoming CEP with it.

The cleanup tests whether qp->cep is non-NULL and assumes the current

call installed the association. However, qp->cep can point to the CEP

of an existing connection. The cleanup then drops a reference from the

incoming cep, not qp->cep. Once the incoming endpoint loses its

remaining references, this can free it before the subsequent cep->qp

store, causing a use-after-free. It also clears the existing QP

association.

Only release the association reference when qp->cep is the incoming

CEP. This preserves an existing association and avoids accessing the

freed endpoint.