CVE-2026-68417
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, the RDMA/siw driver's siw_create_qp() function calls siw_qp_add() before the QP is fully initialized, allowing other components to access a partially constructed QP. The fix moves siw_qp_add() to the end of the function after full initialization.
Risk Assessment
A partially initialized QP may be accessed by other threads, potentially leading to malfunction, information leaks, or system crashes.
Recommendation
Apply the kernel patch that moves QP publication after initialization to prevent access to unprepared objects.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed. Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.