RDMA/siw: Fix endpoint/socket association handling
CVE-2026-74345 · published 15 Aug 2026
How serious is it
- Severity: critical, CVSS score 9.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-74345?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 to < ff584d3735b13a1d7f8cd072f98fea40b6062518, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 to < b28d513393f81e2de00f82970487a9d001557e4e, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 to < f6183983ce1ff254d629a333739082b39d7c5eb6, 6c52fdc244b5ccc468006fd65a504d4ee33743c7 to < b6cf763eee0a932792bef64ceaca568d324192fc
- Linux Linux: 5.3
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix endpoint/socket association handling
Disassociating a socket from an endpoint via siw_socket_disassoc() may
release the last reference on that endpoint and free it. Therefore, don't
clear the endpoints socket pointer after calling that function, but
within.
This fixes a:
BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
which occurred after processing a malformed MPA request during connection
establishment, causing the new endpoint to be closed.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/ff584d3735b13a1d7f8cd072f98fea40b6062518
- git.kernel.org/stable/c/b28d513393f81e2de00f82970487a9d001557e4e
- git.kernel.org/stable/c/f6183983ce1ff254d629a333739082b39d7c5eb6
- git.kernel.org/stable/c/b6cf763eee0a932792bef64ceaca568d324192fc
- git.kernel.org/stable/c/ea4f6f6c53577fb3f05dbd78b15e586772d49831
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON