CVE-2026-23242

Vulnerability

Analysis

CVE-2026-23242 is a null-pointer dereference vulnerability in the Linux kernel's RDMA/siw (Software iWARP) driver. The root cause is that in the error path of siw_tcp_rx_data(), if siw_get_hdr() returns -EINVAL before set_rx_fpdu_context() is called, the qp->rx_fpdu pointer remains NULL. The code then unconditionally dereferences qp->rx_fpdu->more_ddp_segs without a prior NULL check, leading to a crash as evidenced by the KASAN report [1].

Exploitation

An attacker who can send a crafted TCP segment to the siw interface can trigger this condition. The attack requires network access to the target machine and the ability to send traffic that causes siw_get_hdr() to fail early. No authentication is needed beyond being able to reach the siw endpoint [1].

Impact

Successful exploitation results in a kernel NULL pointer dereference, which manifests as a denial of service (DoS) through a system crash or kernel panic. The KASAN splat shows the crash occurs in siw_tcp_rx_data with null-ptr-deref at address 0xc0 [1]. The CVSS v3 score is 7.5 (High) reflecting the high availability impact.

Mitigation

The fix is to only check more_ddp_segs when rx_fpdu is present. The patch has been committed to the stable kernel tree [4]. Users should apply the latest kernel updates to resolve this vulnerability.