{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23242", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.989Z", "datePublished": "2026-03-18T10:05:05.108Z", "dateUpdated": "2026-05-11T22:03:04.396Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:03:04.396Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix potential NULL pointer dereference in header processing\n\nIf siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),\nqp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()\ndereferences qp->rx_fpdu->more_ddp_segs without checking, which\nmay lead to a NULL pointer deref. Only check more_ddp_segs when\nrx_fpdu is present.\n\nKASAN splat:\n[ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]\n[ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_rx.c"], "versions": [{"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91", "lessThan": "ab61841633d10e56a58c1493a262f0d02dba2f5e", "status": "affected", "versionType": "git"}, {"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91", "lessThan": "8564dcc12fbb372d984ab45768cae9335777b274", "status": "affected", "versionType": "git"}, {"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91", "lessThan": "ab957056192d6bd068b3759cb2077d859cca01f0", "status": "affected", "versionType": "git"}, {"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91", "lessThan": "ffba40b67663567481fa8a1ed5d2da36897c175d", "status": "affected", "versionType": "git"}, {"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91", "lessThan": "87b7a036d2c73d5bb3ae2d47dee23de465db3355", "status": "affected", "versionType": "git"}, {"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91", "lessThan": "714c99e1dc8f85f446e05be02ba83972e981a817", "status": "affected", "versionType": "git"}, {"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91", "lessThan": "ce025f7f5d070596194315eb2e4e89d568b8a755", "status": "affected", "versionType": "git"}, {"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91", "lessThan": "14ab3da122bd18920ad57428f6cf4fade8385142", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_rx.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.252", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.10.252"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.15.202"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.1.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.128"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.18.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.19.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ab61841633d10e56a58c1493a262f0d02dba2f5e"}, {"url": "https://git.kernel.org/stable/c/8564dcc12fbb372d984ab45768cae9335777b274"}, {"url": "https://git.kernel.org/stable/c/ab957056192d6bd068b3759cb2077d859cca01f0"}, {"url": "https://git.kernel.org/stable/c/ffba40b67663567481fa8a1ed5d2da36897c175d"}, {"url": "https://git.kernel.org/stable/c/87b7a036d2c73d5bb3ae2d47dee23de465db3355"}, {"url": "https://git.kernel.org/stable/c/714c99e1dc8f85f446e05be02ba83972e981a817"}, {"url": "https://git.kernel.org/stable/c/ce025f7f5d070596194315eb2e4e89d568b8a755"}, {"url": "https://git.kernel.org/stable/c/14ab3da122bd18920ad57428f6cf4fade8385142"}], "title": "RDMA/siw: Fix potential NULL pointer dereference in header processing", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix potential NULL pointer dereference in header processing\n\nIf siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),\nqp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()\ndereferences qp->rx_fpdu->more_ddp_segs without checking, which\nmay lead to a NULL pointer deref. Only check more_ddp_segs when\nrx_fpdu is present.\n\nKASAN splat:\n[ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]\n[ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/siw: Soluciona una posible desreferencia de puntero NULL en el procesamiento de encabezados\n\nSi siw_get_hdr() devuelve -EINVAL antes de set_rx_fpdu_context(), qp->rx_fpdu puede ser NULL. La ruta de error en siw_tcp_rx_data() desreferencia qp->rx_fpdu->more_ddp_segs sin verificar, lo que puede llevar a una desreferencia de puntero NULL. Solo verificar more_ddp_segs cuando rx_fpdu est\u00e1 presente.\n\nKASAN splat:\n[ 101.384271] KASAN: desreferencia de puntero nulo en el rango [0x00000000000000c0-0x00000000000000c7]\n[ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50"}], "id": "CVE-2026-23242", "lastModified": "2026-04-02T15:16:26.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-03-18T11:16:15.887", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/14ab3da122bd18920ad57428f6cf4fade8385142"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/714c99e1dc8f85f446e05be02ba83972e981a817"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8564dcc12fbb372d984ab45768cae9335777b274"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87b7a036d2c73d5bb3ae2d47dee23de465db3355"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab61841633d10e56a58c1493a262f0d02dba2f5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab957056192d6bd068b3759cb2077d859cca01f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce025f7f5d070596194315eb2e4e89d568b8a755"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ffba40b67663567481fa8a1ed5d2da36897c175d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: RDMA/siw: Fix potential NULL pointer dereference in header processing", "id": "2448602", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448602"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23242", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23242\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23242\nhttps://lore.kernel.org/linux-cve-announce/2026031816-CVE-2026-23242-a8b5@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b6a361b8c482f22ac99c3273285ff16b23fba91,ab61841633d10e56a58c1493a262f0d02dba2f5e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8564dcc12fbb372d984ab45768cae9335777b274,ab957056192d6bd068b3759cb2077d859cca01f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ab61841633d10e56a58c1493a262f0d02dba2f5e,ab957056192d6bd068b3759cb2077d859cca01f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ab957056192d6bd068b3759cb2077d859cca01f0,ffba40b67663567481fa8a1ed5d2da36897c175d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffba40b67663567481fa8a1ed5d2da36897c175d,87b7a036d2c73d5bb3ae2d47dee23de465db3355)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[87b7a036d2c73d5bb3ae2d47dee23de465db3355,714c99e1dc8f85f446e05be02ba83972e981a817)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[714c99e1dc8f85f446e05be02ba83972e981a817,ce025f7f5d070596194315eb2e4e89d568b8a755)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ce025f7f5d070596194315eb2e4e89d568b8a755,14ab3da122bd18920ad57428f6cf4fade8385142)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.252,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.202,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.165,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.128,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.75,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.14,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.4,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-02T22:47:42.060503+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the RDMA/siw NULL-pointer dereference fix referenced by the commit history provided", "Verify the deployed kernel version with \"uname -r\" and compare it against the commit hash included in the patch documentation", "Monitor kernel logs for KASAN null\u2011pointer dereference messages that match the described pattern", "If a kernel upgrade is not immediately possible, restrict or block RDMA traffic on the affected hosts or temporarily unload the siw module to prevent exploitation"], "summary": {"action": "Patch ASAP", "impact": "Denial of Service via Kernel Crash"}, "threat_synthesis": {"affected_systems": "The affected product is the Linux kernel itself. No specific kernel versions are listed in the advisory, so any system that includes the RDMA/siw module before the fix is considered vulnerable. Administrators should assume all current distributions containing this code path are at risk until the patch is applied.", "description_and_impact": "The vulnerability resides in the RDMA/siw subsystem of the Linux kernel. When siw_get_hdr() fails and returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() then dereferences qp->rx_fpdu->more_ddp_segs without checking if rx_fpdu is present, causing a kernel crash. KASAN logs demonstrate a null-pointer dereference, which results in a denial\u2011of\u2011service condition without any direct evidence of privilege escalation from the available data.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not currently in the CISA KEV catalog. The likely attack vector is remote, inferred from the fact that the vulnerable code processes incoming RDMA traffic; an attacker would need to send crafted SiW packets to trigger the crash. If exploited, the crash would disrupt system availability and could potentially allow further local privilege escalation if the system does not recover automatically."}}}}, "created": "2026-03-18T12:12:46.954087+00:00", "updated": "2026-04-03T09:39:25.800251+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}